Privacy and protection of PII

Processing of personal data is only lawful if one of the legal bases set out in the General Data Protection Regulation is met. The organization must be able to communicate the purpose of the processing and the legal basis to the data subject and, where appropriate, to the supervisory authority.

The documentation shall include at least:

• the legal basis for the processing and the necessary additional information
• the parties to whom the processing has been outsourced
• related data sets

Our organization has determined whether a data protection officer should be appointed and, if so, made an appointment.

The Data Protection Officer shall be appointed if:

• the organization handles sensitive information on a large scale
• the organization monitors people on an extensive, regular, and systematic basis
• the organization is a public administration actor

In addition to the appointment, it is essential to regularly assess whether the Data Protection Officer is acting in the role and performing the tasks required by the Data Protection Regulation.

With regard to the processing of personal data, the data subject must be provided with the information specified in the GDPR in a concise, comprehensible and easily accessible form. This is often done in the form of privacy statements, which are published, for example, on the organisation's website.

Where personal data have not been collected from the data subject himself, the descriptions shall state, in addition to the basic content:

• where the data were obtained
• which categories of personal data are covered

The Data Protection Officer (or other responsible person) has drawn up operating instructions for personnel handling personal data. In addition, the Data Protection Officer is ready to advise the controller, personal data processing partners or their own staff on compliance with GDPR or other data protection requirements.

The organization must document all personal data breaches and their consequences and the corrective actions taken, regardless of the action ultimately resulting from the breach.

Failure to comply with the documentation obligation or notification is contrary to GDPR and may lead to sanctions defined on the regulation.

Whenever we process personal data, the data subject has certain rights, e.g. gain access to their data and, in certain situations, oppose processing or have their data deleted.

We have planned procedures for handling data subject requests, which may include e.g.:

• the ways in which the data subject may make a request for information
• methods to verify the identity of the sender
• the persons to whom requests for information are forwarded in relation to each register