GDPR Cheat Sheet (What You Need To Know)

What is the GDPR?

GDPR stands for General Data Protection Regulation. It's a European digital privacy legislation. It sets our rules regarding personal data designed to give the EU residents more control over their personal data.

It applies to all organisations within the EU, as well as those supplying goods or services to the EU or monitoring EU citizens.

Why is the GDPR important?

TLDR: It protects and gives control to users in the face of a trillion-dollar data selling industry. If you do something wrong, big fine.

Today almost every service we use collects our data.  From social media companies to banks, retailers, and governments every service requires the collection and analysis of personal data.

They collect data that they ask from us (contact details, work-related data...) but also some that we don't give up.

Before the GDPR, a company would be able to do more or less whatever they wanted with this data. Today this has changed as it limits what companies can do with that information.

The reason for them toning it down is the big fines. GDPR fines can go up to €20 million (about $25 million USD) or 4% of the company’s global annual revenue (whichever is greater) and the average fine for an SME is €40,000.

Do you need to comply with the GDPR?

If you're a business with an online component, 95% of the time yes. Here's the TLDR:

Do you process personal data?

Personal data is any that can be used to identify an individual directly or indirectly. For example name, email address, passport number, date of birth...

There's a catch:

It doesn't have to be a data point. Look at the stormtrooper with a shoulder pad. Say that we know the id of every stormtrooper and we also know if they wear a shoulder pad or not.

We can directly identify the stormtrooper with the shoulder pad! That means that things that are not directly obvious as personal data could be personal data too as they identify people indirectly.

Stormtrooper Id -> identifies them directly

Do they have a shoulder pad -> doesn't identify them directly

‍

If we have a group in which only 1 stormtrooper has a shoulder pad:

Do they have a shoulder pad -> identifies them directly

Do you offer services in the EU?

1. If your company is based in the EU that processes the personal information of EU citizens and residents.

2. If your company is not based in the EU but offers products or services to EU citizens or residents or monitor their behaviour.

What does it mean to "offer products or services"?

Some interpretations state that having a website in the language of one of the member states (English, Spanish, French) is enough for you to qualify as offering products or services.

GDPR Compliance Checklist

The best practices or the minimum set of steps to ensure compliance with the GDPR can be classified as –

Step 1 - List all the data categories you use

The categories can be summarised as follows:

• Contact Details (email address, address, phone number, name)
• Financial Data (credit card number, bank account number...)
• Household and Relationships Data (emergency contact, marital status...)
• Identifiers and Legal Documents (Public Health Number, Passport Number, Proof of Residence)
• Activity and Behavioural (Follower list, Friend Requests...)
• Personal Characteristics (Sex, Nationality...)
• Location Data (GPS Location, tracking data...)
• Communications Data (Instant messaging, social media posts about an individual)
• Images and Recordings (CCTV Footage, images, videos...)
• Views and Opinions (Survey responses, testimonials...)
• Work-related Data (details of grievance, disciplinary proceedings...)
• Technical Identifiers (IP Addresses, Mac Address...)
• Criminal Records

Step 2 - List all the Sensitive Personal Data Categories that you use

Here's a list of sensitive personal data categories also called special category data:

• Racial or Ethnic Origin
• Medical Data
• Sexual Orientation Data
• Biometrics Data
• Genetic Data
• Political Opinions
• Religious or Philosophical Beliefs
• Trade Union Membership
• Sex Life Data

Step 3 - List all the categories of individuals (or data subjects) that you process data from

Examples include:

• Website Visitors
• Customers
• Staff
• Temporary Staff
• Patients
• Children (under the age of 16)
• Children (under the age of 13)

Step 4 - Write out all the purposes for which you use data

Consider all of the activities within your organization and take into account the parties involved. This will guide you across all scenarios relevant to this data security exercise. Examples include:

• Processing Payroll
• Offering your goods and services
• Customer Support
• B2B Email Marketing

Step 5 - Put all the above steps together.

For every purpose for which you process data, select whose data you're processing (individual), which data are you processing (sensitive personal data categories and personal data categories).

Repeat for every single purpose for every individual for every category of personal data.

Step 6 - Choose a legal justification (sometimes called legal basis)

For every purpose, individual, category combination you must choose the right legal basis so that you are processing data in a legal way.

Step 7 - Creating a Privacy Policy

Your Privacy Policy should include the name of your company, explain what and why the company is collecting information (you mapped this in the last steps) and rights that users have. This privacy policy document should be easy to read and easy to find by the users.

Step 8 - Make the Privacy Policy publicly available

Users must be able to read it before any data is collected from them.

Step 9 - Review these steps every quarter

GDPR Compliance is an ongoing process. Your company as it grows can change a lot from one quarter to another and naturally so does your data.

Breach Notification

GDPR Breach Notification requirements have become increasingly important for businesses of all sizes. If a business fails to adhere to the notification regulations laid out in the GDPR, then a hefty fine can be applied. Thankfully, with the right resources and education, businesses can properly prepare themselves to protect sensitive information safely. It's important to ensure that all employees are regularly trained on best practices. Employers should also stay up-to-date on any changes or updates to breach notification laws so that their business is knowledgeable and compliant with current regulations. With the right preparation and dedication, any business can ensure they meet the expectations of GDPR Breach Notification regulation while preventing disaster down the road.

Pseudonymisation And GDPR

Pseudonymisation is a powerful tool when it comes to GDPR compliance. It works by replacing or obscuring personally identifiable information with a pseudonym, making it easier to accurately identify people while still protecting their privacy. This process helps reduce the risk of security breaches as well as helping keep data sets secure and compliant with the GDPR. It's an effective way to meet GDPR requirements for certain types of legally-mandated data protection measures, such as consent and notification. Plus, data collected through pseudonymisation will often be summarized more accurately without sacrificing the privacy of individuals within the data set. All in all, pseudonymisation is an important element of any comprehensive GDPR strategy and should be considered for its potential benefits.

Conclusion

If you think that you may not have all the knowledge necessary or time to go through the steps above. You can always try our solution by going to https://app.privasee.io, most of our users complete all the steps and even get a cookie policy and a GDPR Essentials Certificate in less than an hour with our GDPR Compliance Software.

This compliance checklist is not exhaustive and you should take the necessary procedures to ensure there are no consequences to your own data subjects. As an example, we recommend you have other security measures in place like appoint a specific Data Controller to avoid penalties.

Disclaimer

This article does not constitute legal advice in any form and only seeks to break down some of the main points set out by publicly available sources such as the ICO.