Home

Blog

Content available in English.

The GDPR has been in force for five months. While most publications focus on the (hefty) sanction regime, the GDPR is mainly about accountability. It provides data subjects with rights to take control over their own personal data and obliges organisations to facilitate these rights. It also requires organisations to have much more insight into their own data processing activities. This is primarily reflected in three documentation obligations: for processing activities, for data protection impact assessments and for data breaches.

Over the past year, we have been working on improving the Link personal data and data sources function. It took us more time than we hoped for, because it appeared hard to make the user interaction really simple. From early November, we will make available the new Group editor. This enhances current functionality in order to give more freedom of expression and greatly facilitates the actual grouping activity.

Before conducting an international data transfer, organisations need to check the GDPR very carefully. International data transfers should not only be compliant with Chapter 5 but also with all other requirements of the GDPR (following from Article 44 GDPR). Also, in order to transfer personal data outside the EU, organisations need to follow the layered approach of the European Data Protection Board.

The European Economic Area (EEA) is the combination of European Union (EU) and European Free Trade Association (EFTA) states, except for Switzerland. The EEA has now incorporated the GDPR into the EEA agreement. This was done by an EEA Joint Committee Decision dated 6th July 2018, which came into force on 20th July, 2018. 

The GDPR imposes many rights and obligations on organisations that require software support. Any software supplier will have to make decisions on how to interpret the GDPR and where GDPR compliance software or data processing is needed. Because of the countless vague concepts in the Regulation, suppliers will have different interpretations which of course can lead to a varied number of outcomes within the software.

The fines usually attract the most attention when discussing the GDPR. Four percent of your worldwide annual turnover sounds scary - and ‘fear, uncertainty and doubt’ sell. But when we focus on the main risk of being noncompliant with the new privacy regulation, then the logical conclusion is that your reputation is what is at stake. So, how can you safeguard your organisation’s reputation in the field of personal data protection?

International data transfers are unavoidable for most of the businesses and organisations in today’s digital world. The GDPR takes a balanced approach between the necessity of cross-border data flows for the purposes of international trade and the level of protection provided to natural persons. Although the Regulation allows the free flow of personal data between Member States, it restricts data transfers to countries outside the European Economic Area (EEA).

To protect the rights of the data subjects it is crucial to determine the controller and processors for data processing activity, as these individuals or teams can be held accountable for activities regarding difference stages of data management. Considering the complex business structures in today’s world, the legal obligations attached to these two roles can be misinterpreted. Although controller and processor roles seem similar at first, they in fact have distinct features and distinct legal obligations and each can be aided by the use of effective GDPR compliance software.

Although it has been almost two months since the GDPR’s launch across the EU, there are still organisations that have not started working towards compliance with the new law. These are mostly small and medium enterprises (SMEs) that believe they are immune to the GDPR and the potential fines imposed as a result of data breaches. Of course, they are not. 
 

Previously, I wrote a blog post (see here) on data breaches and where to report them, focusing on the notion of ‘lead supervisory authority’. In this blog post, I focus on the contents of data breach notifications in relation to the GDPR. It is important to notice that notifications might be to either of two stakeholders: the supervisory authority and/or the data subjects concerned (the ‘victims’ of the data breach).

Pages