By
Alex Franch
March 17, 2023
GDPR stands for General Data Protection Regulation. It's a European digital privacy legislation. It sets our rules regarding personal data designed to give the EU residents more control over their personal data.
It applies to all organisations within the EU, as well as those supplying goods or services to the EU or monitoring EU citizens.
TLDR: It protects and gives control to users in the face of a trillion-dollar data selling industry. If you do something wrong, big fine.
Today almost every service we use collects our data. From social media companies to banks, retailers, and governments every service requires the collection and analysis of personal data.
They collect data that they ask from us (contact details, work-related data...) but also some that we don't give up.
Before the GDPR, a company would be able to do more or less whatever they wanted with this data. Today this has changed as it limits what companies can do with that information.
The reason for them toning it down is the big fines. GDPR fines can go up to €20 million (about $25 million USD) or 4% of the company’s global annual revenue (whichever is greater) and the average fine for an SME is €40,000.
If you're a business with an online component, 95% of the time yes. Here's the TLDR:
Personal data is any that can be used to identify an individual directly or indirectly. For example name, email address, passport number, date of birth...
It doesn't have to be a data point. Look at the stormtrooper with a shoulder pad. Say that we know the id of every stormtrooper and we also know if they wear a shoulder pad or not.
We can directly identify the stormtrooper with the shoulder pad! That means that things that are not directly obvious as personal data could be personal data too as they identify people indirectly.
Stormtrooper Id -> identifies them directly
Do they have a shoulder pad -> doesn't identify them directly
If we have a group in which only 1 stormtrooper has a shoulder pad:
Do they have a shoulder pad -> identifies them directly
1. If your company is based in the EU that processes the personal information of EU citizens and residents.
2. If your company is not based in the EU but offers products or services to EU citizens or residents or monitor their behaviour.
Some interpretations state that having a website in the language of one of the member states (English, Spanish, French) is enough for you to qualify as offering products or services.
The best practices or the minimum set of steps to ensure compliance with the GDPR can be classified as –
The categories can be summarised as follows:
Here's a list of sensitive personal data categories also called special category data:
Examples include:
Consider all of the activities within your organization and take into account the parties involved. This will guide you across all scenarios relevant to this data security exercise. Examples include:
For every purpose for which you process data, select whose data you're processing (individual), which data are you processing (sensitive personal data categories and personal data categories).
Repeat for every single purpose for every individual for every category of personal data.
For every purpose, individual, category combination you must choose the right legal basis so that you are processing data in a legal way.
Your Privacy Policy should include the name of your company, explain what and why the company is collecting information (you mapped this in the last steps) and rights that users have. This privacy policy document should be easy to read and easy to find by the users.
Users must be able to read it before any data is collected from them.
GDPR Compliance is an ongoing process. Your company as it grows can change a lot from one quarter to another and naturally so does your data.
GDPR Breach Notification requirements have become increasingly important for businesses of all sizes. If a business fails to adhere to the notification regulations laid out in the GDPR, then a hefty fine can be applied. Thankfully, with the right resources and education, businesses can properly prepare themselves to protect sensitive information safely. It's important to ensure that all employees are regularly trained on best practices. Employers should also stay up-to-date on any changes or updates to breach notification laws so that their business is knowledgeable and compliant with current regulations. With the right preparation and dedication, any business can ensure they meet the expectations of GDPR Breach Notification regulation while preventing disaster down the road.
Pseudonymisation is a powerful tool when it comes to GDPR compliance. It works by replacing or obscuring personally identifiable information with a pseudonym, making it easier to accurately identify people while still protecting their privacy. This process helps reduce the risk of security breaches as well as helping keep data sets secure and compliant with the GDPR. It's an effective way to meet GDPR requirements for certain types of legally-mandated data protection measures, such as consent and notification. Plus, data collected through pseudonymisation will often be summarized more accurately without sacrificing the privacy of individuals within the data set. All in all, pseudonymisation is an important element of any comprehensive GDPR strategy and should be considered for its potential benefits.
If you think that you may not have all the knowledge necessary or time to go through the steps above. You can always try our solution by going to https://app.privasee.io, most of our users complete all the steps and even get a cookie policy and a GDPR Essentials Certificate in less than an hour with our GDPR Compliance Software.
This compliance checklist is not exhaustive and you should take the necessary procedures to ensure there are no consequences to your own data subjects. As an example, we recommend you have other security measures in place like appoint a specific Data Controller to avoid penalties.
This article does not constitute legal advice in any form and only seeks to break down some of the main points set out by publicly available sources such as the ICO.
Ensure your policies are always up to date with Privasee, an AI powered GDPR compliance solution that does it all.