Blog » DO NOT PLAY THE PAPERS! – 5 MUST-HAVE DOCUMENTS TO BE GDPR COMPLIANT
DO NOT PLAY THE PAPERS! – 5 MUST-HAVE DOCUMENTS TO BE GDPR COMPLIANT
09 March 2018
Last week during a GDPR related meeting with one of our clients, he told us: honestly, I have the feeling that this GDPR project is all about paperwork. Although it is not entirely true, we totally agree with our client that a huge part of the compliance project is drafting and adopting several documents. In this article we summarized the 5 basic types of documents that you must have in order to achieve GDPR-compliance.
1. Records of data processing activities
It is clear from the GDPR that both data controllers and data processors shall maintain a record of processing activities which contains certain information (eg. categories of processed data, data transfers to third countries etc.)
The content of the controllers’ and processors’ records is different: for example, while the records of a controller contain the data detention periods, it is obviously not an element of the processors’ records as he is not the one who establishes these periods.
If during the review of your processing activities you were identified both as a controller and a processor, we have great news for you: you need to maintain two records. For example, the haulier is a controller in relation with his own employees (record 1) but is a processor in relation with the data of his client’s customers (record 2).
2. Internal data protection and data processing policy
The GDPR sets forth that controllers shall implement appropriate technical and organizational measures to ensure the GDPR compliance which include the adoption of data protection policies.
Thus, it is kind of obligatory to adopt an internal data protection policy which describes all data processing activities, the liabilities and tasks in relation with the data protection in the organization, the measurements made in relation with data security, the rights of the data subjects and how to handle their requests.
3. Information „packages”
One of the most important goal of the GDPR was to ensure that data subjects are well informed, they understand what happens with their personal data and they have effective rights in relation with the processing of their data.
4. Data breach incident records
Considering all the information security measures you implemented in order to be GDPR-compliant, you should not experience any data breach incidents at all. However, unfortunately even the best practices cannot exclude the possibility of an incident.
Thus, on a “hope for the best but prepare for the worst” basis you will need to have a data breach incident records. This documents the data breaches, their effects and the actions you have taken to mitigate the risks.
5. Data processing contracts
Regardless that you are a controller or a processor (or both if different contexts) you will need to conclude a (data processing) contract with the other party (processor or controller)
This contract among others clearly sets forth the responsibilities of both parties in relation with the certain processing activities. It is important to mention that the contact shall be in writing (including electronic form).
If you are a processor it is your interest to act in accordance with the data processing contract as otherwise you may be considered as a controller which clearly increases your liabilities.
To sum up the above: GDPR is not only about paperwork but it is clearly a very important and big part of your compliance project. Indeed, if the supervisory authority knocks on your door that he wants to investigate your processing activities, first thing he will tell you is: show me your data protection related documents.
LAWFUL DISMISSAL IN HUNGARY - PART VI: TERMINATION WITHOUT NOTICE
In the last two articles of our series on “lawful dismissal” we present the most severe sanction that can be applied to an employee, the immediate (formerly: extraordinary) termination. This measure is applied in serious incidents only, so many employers believe that they will not need to use the sanction. But, as we know, the devil does not sleep and it is in the details, so the employer needs to be prepared for this scenario as well to avoid further inconvenience.Read more »
5 CURRENT GDPR-FINES ACROSS EUROPE – LEARN FROM OTHERS’ MISTAKES
The supervisory authorities in Europe controlling compliance with the GDPR have not sat on their hands in the last couple of months. In this short article we collected five interesting cases from the recent past. The wide discretionary powers of the data protection authority is well illustrated by the fact that sometimes the GDPR fine was only EUR 2000, but in another case a company has been fined for EUR 11,5 Million! Continue reading if you would like to avoid the same or similar expensive errors.Read more »
LAWFUL DISMISSAL IN HUNGARY - PART V: PROTECTION AGAINST DISMISSAL
In the previous articles on the lawful dismissal, we discussed that, ranging from the employee’s behaviour to the employer’s reorganization, there can be many legitimate reasons for dismissal by the employer. However, irrespective of the legitimate reason, the employment relationship cannot be terminated if the employee is protected against dismissal by law (i.e. the Labour Code). From our article, you can learn about these protections.Read more »