GDPR Obligations For Businesses Made Simple
A concise overview of the main GDPR obligations for businesses and how we can support compliance.
Information to data subjects
Under the GDPR, controllers must provide data subjects with specific information about the processing of their personal data at the point of collection — including purposes, lawful basis, categories of data and recipients.
How we support. We prepare general privacy notices for the business as well as tailored notices for employees and directors.
Controller-processor agreements
Where processing is carried out by a processor on behalf of a controller, a controller-processor agreement is required covering the matters prescribed by the GDPR.
How we support. We identify the processing activities that need to be regulated and draft the relevant data processing agreements.
Transfers of personal data
Transfers of personal data outside the EU require appropriate safeguards under applicable data protection laws — typically the EU Commission’s standard contractual clauses.
How we support. We identify transfers that require safeguards and draft the relevant data transfer agreements.
Data Protection Officer
Controllers and processors are required to designate a DPO where certain criteria are met.
How we support. We assess whether a DPO is required in the specific circumstances of the business.
Register of processing activities
Controllers are required to maintain a record of processing activities where certain criteria are met.
How we support. We prepare the register based on information collected for each processing activity.
Data Protection Impact Assessment
A DPIA is required for envisaged processing operations where certain criteria are met.
How we support. We assess whether a DPIA is required for a particular processing activity.
Lawful basis and principles of processing
Personal data must be processed lawfully on one of the bases set out in the GDPR, with additional requirements for special categories of data.
How we support. We determine the appropriate lawful basis for each processing activity of the business.