General Data Protection Regulation (GDPR)

1. the name and contact details of the controller and, where applicable, the joint controller, the controller's representative and the data protection officer;
2. the purposes of the processing; 
3. a description of the categories of data subjects and of the categories of personal data; 
4. The categories of recipients to whom the personal data have been or will be disclosed including recipients in third countries or international organizations;
5. Where applicable, transfers of personal data to a third country or an international organization, including the identification of that third country or international organization and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards;
6. Where possible, the envisaged time limits for erasure of the different categories of data;
7. Where possible, a general description of the technical and organizational security measures referred to in Article 32(1).

Each controller or controller’s representative is required to maintain record of processing activities under its responsibility. Some of the information that shall be included in these records include the name and contact details of the controller, controller’s representative and/or data protection officer, the purpose of the processing, categories of recipients to whom the personal data have been or will be disclosed including the recipients in third countries, categories of data subjects and categories of personal data.

Security of personal data

The General Data Protection Regulation requires the controller and the processor to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, by considering the cost of implementation, the nature, scope, context, purposes of processing and the likelihood and severity of the rights and freedoms of natural persons. The technical and organizational measures recommended to ensure the security of personal data include pseudonymisation through encryption of personal data. Implemented measures shall have the ability to ensure ongoing confidentiality, integrity, availability and resilience of processing systems and services, the ability to restore the availability and access to personal data in the event of a physical and technical incident. GDPR encourages use of the state-of-the-art technology to protect against latest threats. In order to ensure the security of the processing, the controller and the processor shall set in place a system for regularly testing, assessing and evaluating the effectiveness of technical and organization measures. 

The controller and the processor can face different risks while processing. Therefore, when assessing the level of security, they shall consider the risks that have been faced or might be faced in the future processing activities. Some of the risks include the accidental or unlawful destruction of data, loss of data, alteration of data and unauthorized disclosure of, or access to transmitted, stored or processed personal data. 

GDPR requires the controller and the processor to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk identified, assessed and evaluated previously. Some of the measures are: Privacy Impact Assessment (PIA) to assess risk related to the acidity and the processor, Data Protection Impact Assessment, DPIA (in case of high risk processing (special category of personal data)).

In assessing the appropriate level of security, account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, stored or otherwise processed. 

The General Data Protection Regulation has unquestionably enhanced the necessity for a holistic review of security strategies. The information security management system aims to not only protect the companies against technological malfunctions, but also prevent security issues that arise due to a lack of staff awareness. 

ISO 27001, as the international standard on information security management, is employed to encompass three main security related aspects, namely:

Everyday business dynamics require a recovery plan that is adaptable to specific conditions of the organization. The establishment of a business continuity plan yields several benefits, such as:

• Improved reputation
• Improved competitiveness
• Recognized commitment to maintain productivity and meet customer demands regardless of operational difficulties
• Enhanced profitability
• Lower financial volatility
• Enhanced customer trust and confidence 

GDPR encourages the implementation of ISO/IEC 27001 as an approach to ensure easier GDPR compliance. The ISO/IEC 27001 certification supports organizations in creating better business efficiency, safeguards the valuable assets such as personal data, protects staff and organization’s reputation, and simultaneously facilitates the attainment of compliance objectives. Some of the GDPR requirements are not directly covered in ISO/IEC 27001; however, ISO/IEC 27001 provides the means to push you one step closer to accomplishing conformity to the regulation. If you already have an ISO/IEC 27001 framework in place, you will not face duplication of effort, cost and time to comply with GDPR requirements. 

GDPR puts a requirement on all companies to have effective business continuity plans in place. ISO 22301 defines the business continuity requirements and provides recommendations on how to address them, and how to develop procedures to manage disruptive incidents.

Notification of a personal data breach to the supervisory authority

The processor shall notify the controller in case personal data has been breached, without undue delay. Then, the controller is obliged to notify the personal data breach to the supervisory authorities, without undue delay, not later than 72 hours after becoming aware of the breach, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of the natural person. In case the supervisory authority has not been notified within 72 hours, the controller shall state the reasons for providing the information later that requested. 

Both Controllers and Processors must have in place a form of incident management in order to understand, respond and control a breach; otherwise they cannot make the risk determination about the breach and notification to data subjects.

The controller should communicate to the data subject the occurrence of a personal data breach, without delay, where that personal data breach is likely to result in a high risk to the rights and freedoms of the natural person in order to allow him or her to take the necessary precautions.

The communication should describe the nature of the personal data breach as well as recommendations for the natural person concerned to mitigate potential adverse effects. 

This requirement extends a significant load on organizations, especially for those that have to process large amounts of personal data. Because they will need to make significant investments in order to properly inform data subjects in case of a personal data breach (e.g. if data subject’s credit card details have leaked, the organization is responsible for notifying all affected data subjects to replace their credit cards).

Data Protection Officer 

The General Data Protection regulation requires the designation of a data protection officer by the controller and the processor if:

• The processing is carried out by a public authority or body, except for courts acting in their judicial capacity; 
• The core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or 
• The core activities of the controller or the processor consist of processing on a large scale of special categories of data and personal data relating to criminal convictions and offences 
• The organization has over 250 employees 

A DPO can be

• An existing internal employee but that employee’s current roles and tasks must not impact their ability to be a DPO. 
• Someone who is has expert knowledge of data privacy and protection. 
• DPOs can be shared amongst organizations or bodies of organizations 

After assigning a data protection officer, the controller and the processor shall ensure that the data protection officer is involved properly and in a timely manner, in all issues which relate to the protection of personal data. DPOs must report to the highest levels of management and the board. According to GDPR, the assigned data protection officer shall at least have tasks such as:

• Informing and advising the controller or the processor and all employees who carry out processing of their obligations to this Regulation and to other Union or Member State data protection provisions
• Monitoring compliance with the GDPR
• Providing advice where requests as regards the Data Protection Impact Assessment and Monitor its performance
• Cooperating with the supervisory authority
• Act as the contact point for the supervisory authority on issues related to processing

The controller and the processor shall support the data protection officer in performing the above mentioned tasks. 

Transfers of personal data to third countries or international organizations 

The General Data Protection Regulation sets requirements on what should be considered when assessing the adequacy level of protection when transferring personal data to third countries or international organizations. 

If a particular third country has requested to receive certain data, the transfer of such data can be conducted without the obtainment of any authorization, for as long as the Commission has concluded that this country has in place an adequate level of data protection (Adequate Jurisdiction). The list of Adequate Jurisdictions include: Andorra, Argentina, Canada (for organizations that are subject to Canada's PIPEDA law), Switzerland, the Faeroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, and Uruguay. 

Some of the elements that shall be considered when assessing the adequacy level of protection, provided by the GDPR, include:

• The rule of law
• Respect for human rights and fundamental freedoms
• National security, criminal law and the access of public authorities to personal data
• Data protection rules
• Existence and effective functioning of one or more independent supervisory authorities
• Ensure if the implementation of data protection rules are enforced and effective in the third country or international organization

It is possible that the Adequate Jurisdiction conditions may be subject to change, and as a result the jurisdiction no longer assures proper data protection. Consequently, the decisions taken by the Commission should be evaluated and reviewed periodically. By taking into consideration the potential developments, reviews are conducted at least every four years.