By
Alex Franch
January 17, 2023
GDPR stands for General Data Protection Regulation. It's a European digital privacy legislation. It sets our rules regarding personal data designed to give the EU residents more control over their personal data.
It applies to all organisations within the EU, as well as those supplying goods or services to the EU or monitoring EU citizens.
TLDR: It protects and gives control to users in the face of a trillion-dollar data selling industry. If you do something wrong, big fine.
Today almost every service we use collects our data. From social media companies to banks, retailers, and governments every service requires the collection and analysis of personal data.
They collect data that they ask from us (contact details, work-related data...) but also some that we don't give up.
Before the GDPR, a company would be able to do more or less whatever they wanted with this data. Today this has changed as it limits what companies can do with that information.
The reason for them toning it down is the big fines. GDPR fines can go up to €20 million (about $25 million USD) or 4% of the company’s global annual revenue (whichever is greater) and the average fine for an SME is €40,000.
If you're a business with an online component, 95% of the time yes. Here's the TLDR:
Personal data is any that can be used to identify an individual directly or indirectly. For example name, email address, passport number, date of birth...
It doesn't have to be a data point. Look at the stormtrooper with a shoulder pad. Say that we know the id of every stormtrooper and we also know if they wear a shoulder pad or not.
We can directly identify the stormtrooper with the shoulder pad! That means that things that are not directly obvious as personal data could be personal data too as they identify people indirectly.
Stormtrooper Id -> identifies them directly
Do they have a shoulder pad -> doesn't identify them directly
If we have a group in which only 1 stormtrooper has a shoulder pad:
Do they have a shoulder pad -> identifies them directly
1. If your company is based in the EU that processes the personal information of EU citizens and residents.
2. If your company is not based in the EU but offers products or services to EU citizens or residents or monitor their behaviour.
Some interpretations state that having a website in the language of one of the member states (English, Spanish, French) is enough for you to qualify as offering products or services.
The best practices or the minimum set of steps to ensure compliance with the GDPR can be classified as –
The categories can be summarised as follows:
Here's a list of sensitive personal data categories also called special category data:
Examples include:
Examples include:
For every purpose for which you process data, select whose data you're processing (individual), which data are you processing (sensitive personal data categories and personal data categories).
Repeat for every single purpose for every individual for every category of personal data.
For every purpose, individual, category combination you must choose the right legal justification so that you are processing data in a legal way.
We have written a blog post about that here: https://www.privasee.co.uk/post/gdpr-legal-basis
Your Privacy Policy should include the name of your company, explain what and why the company is collecting information (you mapped this in the last steps) and rights that users have. This privacy policy document should be easy to read and easy to find by the users.
Users must be able to read it before any data is collected from them.
GDPR Compliance is an ongoing process. Your company as it grows can change a lot from one quarter to another and naturally so does your data.
If you think that you may not have all the knowledge necessary or time to go through the steps above. You can always try our solution by going to https://app.privasee.io, most of our users complete all the steps and even get a cookie policy and a GDPR Essentials Certificate in less than an hour.
This article does not constitute legal advice in any form and only seeks to break down some of the main points set out by publicly available sources such as the ICO.
Ensure your policies are always up to date with Privasee, an AI powered GDPR compliance solution that does it all.