GDPR: General Data Protection Regulation

 1. Appoint roles and responsibilities

The GDPR makes having a data protection officer (DPO) mandatory for organisations larger than 250 people. But also for organisations with large-scale (or intensive) processing of personal data.

As an organisation, the GDPR requires you to appoint an FG if you track individuals on a large scale or process special personal data of individuals. For both aspects, this must be a core activity of the organisation (source).

• The number of data subjects (the people whose data you process);
• The amount of data you are processing;
• The duration of the data processing;
• The geographic scope of the processing.

A DPO can be appointed internally but can also be organised externally. Furthermore, you can also set up the DPO as a team. For larger organisations, it is further recommended to delegate tasks of the DPO to the various organisational units through so-called privacy officers.

The responsibility of the DPO is to ensure compliance with the GDPR as a supervisor. Tasks to be performed in this regard include performing/attending DPIAs (see step 2), assessing and reporting data breaches (see step 4), and monitoring compliance by auditing and reporting.

Furthermore, you need to determine what your privacy aithority is. If you operate internationally in different countries, this may differ. Consider the location of the headquarters or where large-scale processing of personal data takes place. If this is not immediately clear to your organisation, you can contact your local privacy authority for this.

Within your organisation, you will also want to appoint responsibles for the datasets in which personal data are stored/processed. These 'system owners' are identified in step 2.

And of course the management of the organisation has a responsibility in directing and promoting all activities required to comply with the GDPR.

Examples of organizations with intensive or extensive processing of personal data are:

• Research firm that sends and processes commissioned surveys related to dietary patterns and health;
• A travel agency that books international travel;
• Hospitals, educational institutions, municipalities, etc.

Tip

To get your information management (and by extension security) in order, an inventory of all information systems is highly recommended.

Tip

Don't know where to start? Then make use of any information that may already be available:

• Existing policies;
• List of system owners;
• Assignments / customer contracts;
• Overviews of information flows / information architecture; and
• Audit reports.

Examples of typical processing in organizations:

• HR: personnel administration including applicant data;
• CRM: contact information of customers / leads (e.g. from web forms;
• Support / help desk: contact information of users / customer contacts;
• Procurement/administration: personal information from suppliers, clients and other service providers (insurers etc.); and
• Saas/cloud applications: user data (for identity management purposes).

Base27 offers complete support for the GDPR

2. Identify and record processing activities

Next is to identify the storage/processing of personal data by your organisation. You can do this on the basis of information systems used or on the basis of processing activities (processes). The choice here is mainly determined by the number of information systems used as well as the nature and size/complexity of the organisation.

If you opt for the information systems approach, you must also identify the processing activities.

For each of the processing operations you need to identify the person responsible, the purpose, those involved, the personal data used and the processors, as well as the period in which the data will be destroyed. Keep in mind that the data used must be proportional to the purpose of the processing.

3.  Concluding processor agreements

If the data is passed on to third parties (processors), you must conclude an agreement with these parties whereby the privacy rules are safeguarded. This can - and preferably should - be done on the basis of a processor agreement. A processor agreement lays down the purpose for which the data may be processed and the responsibilities of the processor. The agreement also imposes a possible fine if the processor defaults.

Such a fine (potentially rising to millions as a result of the GDPR) may be disproportionate for the processor. Therefore, depending on the scope and type of processing, a privacy statement of the processor can also be considered, if this statement sufficiently addresses the required privacy rules. The processor is of course expected to adequately implement this statement.

An alternative is also to impose the same privacy and security requirements on the processor as you as controller apply to the processing of personal data. However, you will then also have the obligation to monitor compliance with these through audits and/or reports. And you will have to periodically evaluate the agreements.