Processing of personal data is only lawful if one of the legal bases set out in the General Data Protection Regulation is met. The organization must be able to communicate the purpose of the processing and the legal basis to the data subject and, where appropriate, to the supervisory authority.
The documentation shall include at least:
Our organization has determined whether a data protection officer should be appointed and, if so, made an appointment.
The Data Protection Officer shall be appointed if:
In addition to the appointment, it is essential to regularly assess whether the Data Protection Officer is acting in the role and performing the tasks required by the Data Protection Regulation.
With regard to the processing of personal data, the data subject must be provided with the information specified in the GDPR in a concise, comprehensible and easily accessible form. This is often done in the form of privacy statements, which are published, for example, on the organisation's website.
Where personal data have not been collected from the data subject himself, the descriptions shall state, in addition to the basic content:
The Data Protection Officer (or other responsible person) has drawn up operating instructions for personnel handling personal data. In addition, the Data Protection Officer is ready to advise the controller, personal data processing partners or their own staff on compliance with GDPR or other data protection requirements.
The organization must document all personal data breaches and their consequences and the corrective actions taken, regardless of the action ultimately resulting from the breach.
Failure to comply with the documentation obligation or notification is contrary to GDPR and may lead to sanctions defined on the regulation.
Whenever we process personal data, the data subject has certain rights, e.g. gain access to their data and, in certain situations, oppose processing or have their data deleted.
We have planned procedures for handling data subject requests, which may include e.g.: