Lawfulness, fairness and transparency
Process personal data on an appropriate legal basis, fairly and transparently for individuals.
GENERAL DATA PROTECTION REGULATION
GDPR.
Clarity for action.
People’s rights and organisations’ responsibilities in personal data processing.
Understand the principlesLawTechnologyTrust
THE ESSENTIALS
Data protection
begins with principles.
The GDPR sets out principles that guide personal data processing and should be reflected in an organisation’s practices.
Purpose limitation
Collect personal data for specified, explicit and legitimate purposes.
Data minimisation
Limit processing to personal data that is adequate, relevant and necessary.
Accuracy
Keep personal data accurate and, where necessary, up to date.
Storage limitation
Keep identifiable personal data only for as long as necessary for the purposes of processing, subject to statutory exceptions.
Integrity and confidentiality
Apply appropriate measures to protect personal data against unauthorised access or processing, loss, destruction or damage.
An introductory summary of Article 5 of the GDPR. Read the official regulation
ACCOUNTABILITY
Know what you do.
Be able to demonstrate it.
The controller must comply with the principles and be able to demonstrate compliance. This requires an understanding of personal data processing, justification of its purposes and legal bases, defined responsibilities and evidence of the procedures and measures adopted.
Discover the RCA assessmentQUESTIONS THAT MATTER
Greater clarity.
Better decisions.
01What is the GDPR?
The General Data Protection Regulation sets out rules for personal data processing and for protecting people’s rights. The official text is available on EUR-Lex.
02Does my organisation need a Data Protection Officer?
Appointment is mandatory in the situations set out in Article 37 of the GDPR and in other cases required by applicable legislation. The assessment considers, among other things, core activities, the nature of the personal data and the scale of processing.
03Where should we start?
Identify personal data processing activities, purposes, legal bases and those responsible. Understand existing procedures, including the information provided to data subjects and the response to the exercise of their rights.
04How do law and technology relate?
Obligations concerning personal data processing and protection are reflected in processes and systems. An integrated approach connects purposes, legal bases and responsibilities with their practical application.
05What should we do if there is an incident?
Act without delay: contain the situation, preserve relevant information and assess whether there is a personal data breach. The need to notify the supervisory authority and inform those affected depends on the risks and applicable legal requirements.
OFFICIAL SOURCES
Knowledge
at its source.
LET’S TALK
Every organisation
has its own context.
We help connect GDPR requirements with your organisation’s processes and decisions.
Speak to a specialist+351 21 330 37 80