After reading, you can find out whether the GDPR applies to you and which duties come first.
Definition
Personal data means any information about an identifiable person. Two roles matter: the controller decides why and how data is used, and the processor handles it on the controller's behalf.
Geography can surprise people. Under Article 3, a company outside the EU is covered if it offers goods or services to people in the EU or monitors their behaviour there.
Why it matters
Article 83 allows fines of up to €20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious infringements.
The everyday pressure often comes from sales, though. Buyers want a processing agreement and security information before they sign.
How it works
Record your processing activities (Article 30). Give each a purpose and one of the six legal bases of Article 6: consent, contract, legal obligation, vital interests, public task or legitimate interests.
Apply the principles of Article 5, tell people what you do, and answer their requests for access, rectification, erasure and the like, generally within one month (Article 12).
Then come security (Article 32), agreements with processors (Article 28) and notification of a reportable breach to the authority within 72 hours (Article 33).
A worked case
A recruitment firm records one activity for job applications. The legal basis is steps prior to a contract. Retention is two years after the last contact, with a note of why, and the recipient is its applicant tracking software, covered by a processor agreement.
When an applicant asks for a copy of their data, the request is logged and answered within three weeks.
Good practices
- Update the record of processing as projects change, while people still remember the details.
- Choose the legal basis before processing starts, since it is hard to change afterwards.
- Set a retention period for each purpose, then actually delete.
- Rehearse a breach and a request from an individual, because both arrive with a deadline.
- Check where each processor stores data and which transfer tool applies.
Common mistakes
- Using consent everywhere. It can be withdrawn at any time, and another basis often fits better.
- Copying a privacy notice that does not match what you do, which turns a paperwork problem into a transparency failure.
- Keeping data “just in case”, against the storage limitation principle.
- Forgetting that a lost laptop can be a personal data breach.
Questions
- Does the GDPR apply to small companies?
- Yes. Size only eases some duties, such as the limited exemption from the record of processing in Article 30(5).
- Is a data protection officer mandatory?
- Only in the cases of Article 37: public authorities, large-scale regular monitoring, and large-scale processing of special category data.
- Must every personal data breach be reported?
- No. It goes to the authority unless it is unlikely to result in a risk to people, and to the people affected when the risk is high (Article 34). You must record all breaches internally.
- Can personal data be transferred outside the EU?
- Yes, under Chapter V: an adequacy decision, appropriate safeguards such as standard contractual clauses, or limited derogations.
- What is the difference between a controller and a processor?
- The controller decides the purposes and means. The processor acts on its instructions and has direct duties of its own.