The General Data Protection Regulation (“GDPR”) is the European Union’s comprehensive privacy law, which likely applies to your organization, even if you have no physical or legal presence in the EU.
The General Data Protection Regulation (GDPR) is a European regulation that aims to improve and standardise how organisations operating across the EU collect, handle, process, and store personal data such as HR records and customer lists.
The GDPR requires organisations to improve information security and governance.
The GDPR affects all organisations that process personal data and operate within or sell goods to the EU. The term “processing” refers to nearly every type of data usage, including collection, storage, retrieval, alteration, storage, and destruction.
The GDPR applies to both ‘controllers’ and ‘processors’ of data. The purpose and manner in which data is processed are determined by data controllers.
Data processors are any third-party who processes data on behalf of a controller.
Principle 6 of the GDPR states that personal data should be processed appropriately to ensure ongoing data security.
Personal data protection against unauthorised processing, accidental loss, and destruction should be a priority for all organisations.
EywaSystems can effectively implement a risk-based GDPR compliance programme for your business.
Our core activities include:
EywaSystems will review your organization’s privacy policy and, if necessary, propose improvements to the existing policy or write a new one, if necessary, to comply with the GDPR. If consent is the most appropriate legal basis for certain data processing operations in your organization, we will analyse your organization’s current data collection points and recommend ways to implement consent management or improve the quality of consent acquired in accordance with the requirements of GDPR Article 7.
In some cases, a data protection impact assessment must be performed before embarking on new data processing initiatives under the GDPR, in accordance with the requirements of GDPR Article 35.
EywaSystems provides comprehensive support and unbiased advice on your DPIA, as well as a DPIA template and documented DPIA procedure template for you to use in conducting your own DPIAs.
A DPIA should include:
– A systematic description of processing operations, including the purpose for processing.
– An assessment of the necessity and proportionality of the processing operations.
– An assessment of the risks to individuals’ rights and freedoms.
– Measures to address identified risks, including safeguards and mechanisms to ensure personal data protection.
* A Data Protection Impact Assessment (DPIA) is a process that identifies and mitigates risks associated with the processing of personal data as early as possible. DPIAs are critical tools for mitigating risk and demonstrating GDPR compliance.