Be compliant

An organisation not only has to process personal data according to the General Data Protection Regulation, but it also needs to be able to demonstrate its compliance. This includes implementing data protection by design, keeping a record of processing activities, and in certain circumstances, conducting a data protection impact assessment.

As a data controller, both when you design a processing operation and at the time of processing, you must implement appropriate measures and safeguards to ensure that data protection principles are complied with. You must also ensure that, by default, only personal data which is necessary for each specific purpose is processed (this applies to the amount of data, the extent of the processing, the storage limitation, and its accessibility).

In other words, an organisation that applies data protection by design and by default is an organisation that considers and embeds data protection and the privacy of individuals in every aspect, and at every stage of its processing operations, in the tools used, or any other business activity.

In order to do so, before setting up any processing operations, your organisation must take into account:

• the nature, context, and scope of the processing operation that is envisaged;
• the risks that may arise from the envisaged processing operations or any other business activities that may have an impact on individuals’ personal data;
• the technical and organisational measures that should be put in place to mitigate the risks identified, and, in doing so, ensure that individuals’ personal data is adequately protected;
• the technical and organisational measures or procedures to be put in place to ensure that processing of personal data (including in particular collection, storage and overall use of individuals’ data) is limited to what is necessary in light of the objectives pursued.

It is useful to keep records of these assessments and measures to be able to demonstrate that you are complying with the principles of data protection by design and by default. An approved certification mechanism may also be used as an element to demonstrate compliance with data protection by design and by default.

As an organisation, you have a duty to keep a record of your data processing activities. These records should be kept in writing, including in electronic form.

This record gives you an overview of your processing activities. In order to create such a record, you should identify which of your activities require processing of personal data (examples include recruitment, payroll management, training, badge and access management, list of prospective customers, etc.). Each of these processing operations must be described in the record with the following information:

• the purpose of the processing (e.g. customer loyalty);
• the categories of data processed (e.g. for payroll: name, first name, date of birth, salary, etc.);
• who has access to the data (the recipients – e.g.: the department in charge of recruitment, the IT service, management, service providers, partners...);
• where applicable, information related to transfers of personal data outside the European Economic Area (EEA);
• where possible, the storage period (the period for which the data are useful from an operational point of view, and from an archiving perspective);
• where possible, a general description of the security measures.

The record of processing activities falls under the responsibility of your organisation’s manager. This record must be available to the data protection authority of the EEA country where you operate, if requested.

It is not required for organisations employing fewer than 250 persons to mention purely occasional activities in their record (e.g. data processed for one-off events such as the opening of a shop.

What is a DPIA?

Where a processing is likely to result in a high risk to the rights and freedoms of individuals, the data controller must carry out a Data Protection Impact Assessment (DPIA). A DPIA is a written assessment of a planned processing operation. It helps you to identify the appropriate safeguards to mitigate the risks and to demonstrate compliance.

When to do a DPIA?

While it is always preferable to anticipate the impact of planned processing operations of your organisation by doing a DPIA, it is compulsory to carry out such a DPIA when the processing is likely to result in a high risk for individuals’ rights and freedoms.

Specifically, this is the case when the envisaged processing involves:

• the processing - on a large scale - of sensitive personal data and data related to criminal convictions;
• a systematic and extensive evaluation of an individual’s personal aspects based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the individual in question or similarly significantly affect individuals;
• systematic monitoring of a publicly accessible area on a large scale.

In most cases, processing operations meeting two of the following criteria should be assessed through a DPIA:

1. evaluation or scoring;
2. automated decision making with legal or similar significant effect;
3. systematic monitoring;
4. sensitive data or data of a highly personal nature;
5. data processed on a large scale:
6. matching or combining datasets;
7. data concerning vulnerable data subjects;
8. innovative use or applying new technological or organisational solutions;
9. When the processing in itself prevents individuals from exercising a right or using a service or a contract.

What to include in a DPIA?

Your DPIA should include:

• a description of the planned processing operation and its purpose;
• a necessity and proportionality assessment; 
• the risks that the processing operation may entail;
• the measures to address the risks.

Prior consultation during a DPIA

Whenever the data controller cannot find sufficient measures to reduce the risks to an acceptable level (i.e. the residual risks are still high), consultation with the data protection authority is required. In that case, the data controller must provide the following information:

• the respective responsibilities of the controller, joint controllers and processors involved in the processing;
• the purpose of the processing operation and how the processing operation will be conducted;
• the measures envisaged to safeguard individuals’ personal data;
• the contact details of the data protection officer of your organisation, if applicable;
• the DPIA in question.

After a DPIA - Test it, improve it, check it!

Once your DPIA is drafted, you must test it; improve it if necessary; conduct your processing operation; re-assess whether your DPIA matches the processing operation; and control check.

Depending on where your organisation is located in the EEA, there may be associations or other bodies representing data controllers or processors. These associations and bodies may prepare codes of conduct, including data protection mechanisms, that data controllers and processors may adhere to in order to help ensure that individuals’ personal data is respected according to the GDPR.

More specifically, these codes of conduct put in place are to ensure, for instance:

• that personal data is processed in a fair and transparent way;
• that the purposes for which individuals’ personal data is processed are legitimate;
• how to pseudonymise personal data;
• that transparent information is given to individuals’ whose personal data is processed;
• that consent to the processing of individuals’ data, especially personal data related to children, is appropriately sought;
• that all technical and organisational measures are put in place to ensure the secure processing of individuals’ data;
• that procedures for the notification of personal data breaches are followed;
• that procedures, including safeguards, related to transfers of personal data to non-EEA countries and organisations are followed;
• that procedures related to court proceedings and dispute resolutions are followed.

What is a GDPR certification?

An organisation that obtains a GDPR certification can use this certification to demonstrate compliance of its processing operations with the GDPR.

The EEA data protection authorities may, for example:

• issue GDPR certifications in respect of its own certification scheme;
• issue GDPR certifications itself, in respect of its own certification scheme, but delegate the entire, or part of the assessment process to third parties;
• create its own certification scheme, and entrust specific bodies to issue these certifications;
• encourage the market to develop certification mechanisms;
• assess the certification schemes of certification bodies.

A certification body is tasked with issuing, reviewing, and withdrawing certifications on a basis of a certification mechanism and approved criteria.

Certification bodies must document their assessment of your organisation’s processing operations for which a GDPR certification may be issued.

My organisation has received a GDPR certification, what’s next?

The GDPR certification of a processing operation that your organisation carries out is valid for a maximum of 3 years, but can be renewed or revoked. To keep this certification, your organisation must continuously and consistently put into practice the measures surrounding the data protection operation that was certified.