GDPR & Your DATA
Using simple Yes/No questions, our system guides you through the process of becoming GDPR compliant in an efficient but thorough way to ensure that nothing is missed. In response to your answers, tasks are then given to you to complete in the areas where your business is not yet meeting the GDPR requirements.
The GDPR requirements state that consent must be unambiguous and given freely. Our consent management & cookie tool guarantees you not only meet this requirement, but also build user’s trust by being fully transparent with the use of their data. Historic data is stored about when and what each visitor has consented to. This helps you to easily respond to a subject access request (SAR) when a visitor requests their data.
Under the GDPR,
(General Data Protection Regulation)
individuals have:
The right to access 1
this means that individuals have the right to request access to their personal data and to ask how their data is used by the company after it has been gathered. The company must provide a copy of the personal data, free of charge and in electronic format if requested.
The right to be forgotten 2
if consumers are no longer customers, or if they withdraw their consent from a company to use their personal data, then they have the right to have their data deleted.
The right to data portability 3
Individuals have the right to transfer their data from one service provider to another. And it must happen in a commonly used and machine-readable format.
The right to be informed 4
this covers any gathering of data by companies, and individuals must be informed before data is gathered. Consumers have to opt in for their data to be gathered, and consent must be freely given rather than implied.
The right to have information
corrected 5
this ensures that individuals can have their data updated if it is out of date or incomplete or incorrect.
The right to restrict processing 6
Individuals can request that their data is not used for processing. Their record can remain in place, but not be used.
The right to object 7
this includes the right of individuals to stop the processing of their data for direct marketing. There are no exemptions to this rule, and any processing must stop as soon as the request is received. In addition, this right must be made clear to individuals at the very start of any communication.
The right to be notified 8
If there has been a data breach which compromises an individual’s personal data, the individual has a right to be informed within 72 hours of first having become aware of the breach.
- 1. The right to access –this means that individuals have the right to request access to their personal data and to ask how their data is used by the company after it has been gathered. The company must provide a copy of the personal data, free of charge and in electronic format if requested.
- 2. The right to be forgotten – if consumers are no longer customers, or if they withdraw their consent from a company to use their personal data, then they have the right to have their data deleted.
- 3. The right to data portability – Individuals have the right to transfer their data from one service provider to another. And it must happen in a commonly used and machine-readable format.
- 4. The right to be informed – this covers any gathering of data by companies, and individuals must be informed before data is gathered. Consumers have to opt in for their data to be gathered, and consent must be freely given rather than implied.
- 5. The right to have information corrected – this ensures that individuals can have their data updated if it is out of date or incomplete or incorrect.
- 6. The right to restrict processing – Individuals can request that their data is not used for processing. Their record can remain in place, but not be used.
- 7. The right to object – this includes the right of individuals to stop the processing of their data for direct marketing. There are no exemptions to this rule, and any processing must stop as soon as the request is received. In addition, this right must be made clear to individuals at the very start of any communication.
- 8. The right to be notified – If there has been a data breach which compromises an individual’s personal data, the individual has a right to be informed within 72 hours of first having become aware of the breach.
The Business
implications of GDPR
What falls under GDPR compliance?
Regardless of whether data processing occurs in the EU or not, GDPR applies to all companies and organisations that are established within the EU. GDPR will also apply to established organisations outside the EU if it provides goods and/or services to EU citizens.
A data protection officer or data controller who manages GDPR compliance should be appointed by all businesses and organisations that deal with personal data.
Companies and organisations that violate GDPR are subject to severe fines of up to 4% of annual global revenue or 20 million Euros, whichever is the greater.
