The General Data Protection Regulation (GDPR) is a set of regulations created by the European Union (EU) to protect the personal data of individuals within the EU.
Personal data includes any information which, directly or indirectly, could identify a living person, such as name, phone number, and address etc.
Applies to any entity that collects or processes personal data of EU residents, regardless of their location.
Create a project plan for your GDPR implementation and assess your current personal data practices. Ensure that you involve the appropriate stakeholders and conduct a readiness assessment.
Draft an internal personal data policy, additional toplevel policies, as well as conduct employee GDPR training courses. Appoint DPO (data protection officer) to help manage your compliance project.
Map what personal data is collected, its purpose, storage locations, retention periods, security and access permissions.
Enable individuals to access, correct, delete, or object to the processing of their personal data.
The DPIA checks the processes of the company and how they could impact the privacy from whom the data is collected.
Ensure that your mechanisms for transferring personal data outside the EU are GDPR-compliant.
Ensure data protection agreements (DPAs) are signed with appropriate third parties (vendors).
Confirm that each processing activity is based on a lawful justification (e.g., consent, legal obligation, contract).
GDPR requires that data breaches are reported to the data protection authorities within 72 hours of discovery. Ensure you have the necessary processes for detecting and responding to data breaches.
