Pro subscription - DPO Associates

Complete your GDPR File

Hidden

Language

Personal data(Required)

First name Surname

Email address

Phone(Required)

Website/shop url?(Required)

What is your company name?(Required)

What is your VAT number?(Required)

What is the address of your company/organization?(Required)

Street + number City State Zip code Country

Introduction

What business activities does your company carry out ? (as comprehensive as possible)(Required)

e.g. sale of goods, production of goods, transportation, services - which, rental, ...

Mapping your data

Preparing some sort of "data inventory" is a first very important step in your preparation. You should try to map out all the data you are processing.

From whom do you keep personal data?(Required)

Customers

Supplier

Staff

Prospects

subcontractors

Others

What other data

What categories of personal data do you keep?(Required)

Identity information (name, address, phone number, etc.)

Billing information

Sensitive data (health, orientation, etc.)

Others

What other categories(Required)

Where does the data come from ?(Required)

Note: According to the GDPR, you are only allowed to partner with "secure" companies. It is important that you provide this guarantee in your contracts with your partners. (via trade show, contact form, customer form, ... )

Where do you store this personal data? In which database(s) and where are they located?(Required)

(e.g., CRM, ERP, Office 365, Dropbox, G-Suite, ... )

Who all has access to this database?(Required)

What functions do these individuals have?(Required)

Is it really necessary for certain people to have access to this database?(Required)

Is access secured?(Required)

Take the necessary steps to provide security. This can be digital security, but equally a lock on the cabinet where certain documents are kept.

Will this personal data be shared or transferred to another company? Inside or outside the EEA (cloud)?(Required)

Please note: If you correct a personal data, for example, you will have to notify the company to whom you transfer data of this correction. Forwarding to countries outside the EU is only possible if all conditions and obligations regarding forwarding are met (e.g., Art. 13.1 (e); art. 14.1 (f); art. 15.2; art. 30.1 (e); arts. 44-50; ...).

Why do you keep these personal data ?(Required)

Note: You may only collect personal data for specified, explicit and legitimate purposes. Personal data must be relevant and limited to the intended purposes of processing (see below).

How long do you keep records?(Required)

Note: Personal data should not be kept longer than necessary for the intended purposes of processing.

Legal basis for processing personal data.

You may collect and process personal data only when there is a legal basis for doing so (Art. 6).

Check what types of data processing you perform and on what legal basis. Depending on the legal basis, the data subject's rights may vary. For example, the data subject has a stronger right to request the deletion of his/her data if the personal data were processed on the basis of his/her consent (step 4). The legal basis should also be clarified in the Privacy Policy and whenever you answer a right of access (see here). Please tick them below: You are processing personal data as:(Required)

the processing is necessary for the performance of a contract ( (e.g., if a customer orders something and you need to deliver it, then of course you may process that person's address, e.g., if a customer pays online, then of course you may process the credit card details to obtain payment).

the processing is necessary to comply with a legal obligation; (e.g., if you are an employer, you must provide employee data to Social Security).

the processing is necessary for the performance of a task carried out in the public interest;

the processing is necessary to pursue a legitimate interest. (e.g.. health purposes such as public health, social protection, fraud prevention, ... In any case, a balancing of interests will always have to be made (recital 47).)

Sensitive personal data

The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and processing of genetic data, biometric data for the purpose of uniquely identifying a person, or data concerning health, or data relating to a person's sexual behavior or sexual orientation are prohibited (Art. 9).

There are some exceptions to this:

In the case of express consent of the data subject;
To comply with a legal obligation;
To protect vital interests;
Personal data apparently disclosed by the data subject;
When it is necessary to bring an action or when a court is acting within its jurisdiction;
Necessary for reasons of substantial public interest (proportionality to the objective pursued is guaranteed!);
Necessary for purposes of preventive or occupational medicine, for assessing the worker's fitness for work, medical diagnosis, providing health care or social services;
Necessary for public health reasons;
Necessary for the purpose of archiving in the public interest, scientific or historical research or statistical purposes.

I process sensitive personal data:(Required)

Yes

If so, what personal data are processed ?

If one falls under an exemption rule for processing sensitive data, what is it ?(Required)

Similarly, the processing of personal data concerning criminal convictions and offenses can only be done under certain conditions (Art. 10). Are personal data concerning criminal convictions being processed, if so what data are they ?(Required)

Are you asking for permission ?

Asking for consent is a very important act in the GDPR. According to the GDPR, consent must be free, specific, informed and unambiguous. Consent must also always be a clearly affirmative act (arts. 4, 11 and art. 7).
What about past consent? You do not need to request a new consent if the consent already obtained meets the new requirements. If not, you must again properly request permission.

Check this here for your company, tick and complete:(Required)

I envision with consent a voluntary choice, where the data subject can explicitly consent (an "opt-in").

I clearly inform the data subject for what and for what purposes consent is given (cfr. right to information).

I do not infer consent from a silence, a pre-checked box or a non-action.

I envision the possibility for the data subject to withdraw consent at any time. Withdrawing consent is as simple as giving consent, e.g. clearly displaying unsubscribe options.

Otherwise

Otherwise?

Is consent verifiable ?(Required)

Yes

Otherwise

Importantly, consent must also be verifiable at all times. That is, you must be able to show who, when and how consent was given. It is best to record this in a document.

More explanation

If, as a company, you collect and process personal data from children under the age of 16, a parent or guardian will need to give consent (Art. 8). This obligation only applies when the processing is based on consent and when it involves information society services offered. However, member states may determine to set this age even lower (up to 13 years max). This provision does not affect Belgian contract law (e.g., the rules on the validity, formation or effects of contracts in relation to children). You must also be able to prove that you made reasonable efforts to verify consent.(Required)

I retain data from children -16 based on consent.

I maintain a system that allows me to verify consent with parents/guardians.

Attention: children -16!

Are the rights of the data subject guaranteed ?

As a company, you need to be mindful of a lot of rights the GDPR grants to data subjects. Make an accurate evaluation and identify where you may need to make necessary adjustments. It is important to know how you will proceed from now on when someone wants to exercise their right; who is responsible? Does that person know what to do? Is it technically possible?

Is there clear communication and rules for exercising the data subject's rights (Art. 12 GDPR)(Required)

Yes

All information as well as communication must be provided, on the one hand, in a concise, transparent, understandable and easily accessible form, and on the other hand, in clear and simple language. If a data subject invokes a right, you must respond within one month of receiving the request. Depending on the complexity of the request, that deadline may be extended for another 2 months. Right to information (Art. 13 and 14 GDPR) Do you meet this standard ?(Required)

Yes

The regulation specifies what information must be disclosed to your client. This obligation applies whether the data was obtained from the customer himself or indirectly. I do not process personal data without the knowledge of my customers(Required)

Yes

Right of access (Art. 15 GDPR)

The person whose records you keep has the right to see certain records and receive additional information about a lot of things. I also provide a free copy of processed personal data within the month (extendable for 2 months).(Required)

Yes

Right of rectification (Art. 16 GDPR)

The person whose data you maintain has the right to correct inaccurate or incomplete personal data. I notify each recipient to whom I have provided personal data of a correction, unless this is impossible or requires a disproportionate effort (notification obligation Art. 19).(Required)

Yes

Right to erasure / right to oblivion (Art. 17 GDPR)

In some specific cases, the person whose data you maintain may ask to be "forgotten" and removed from your database. You can also refuse the removal request in a number of cases. You will find here a list of, on the one hand, the cases for deletion and, on the other hand, the cases in which you can refuse this request. I will notify each recipient to whom I have provided personal data of a deletion, unless this is impossible or requires disproportionate effort (notification obligation Art. 19).(Required)

Yes

Right to limitation (art. 18)

In a number of cases, the data subject may ask to limit the scope of personal data processed. See Privacy Commission website. I notify each recipient to whom I have disclosed personal data of a restriction, unless this is impossible or requires disproportionate effort (duty to notify Art. 19).(Required)

Yes

Right to data portability (Art. 20 GDPR)

The person whose data you maintain has the right to have personal data they have provided transferred to another company. The data must be transferred free of charge, within a period of one month (extendable by 2 months), in a structured common and electronically readable form. This can only be done for data that the you as a company processes through an automated process and based on consent or agreement.(Required)

Yes

Right to object (Art. 21 GDPR)

The person whose data you keep has the right at all times, due to his specific situation, to oppose the processing of his data (unless stipulated by law or when necessary for the performance of a contract). When data are collected for the purpose of direct marketing (including profiling related to direct marketing), the person concerned may oppose the processing of his data free of charge and without justification. Any person whose data you maintain has the right not to be subjected to fully automated decision-making. The right does not apply when the decision-making 1) necessary to enter into or perform a contract; 2) is allowed by law; 3) is based on express consent. In any case, I inform the person concerned of their right to object and I explicitly state it in the privacy policy(Required)

Automated decision-making, including profiling (Art. 22 GDPR)

Yes

Are you prepared for a data breach

If you are faced with a data breach (e.g., your system was hacked and all of your data was stolen) you have a duty to notify (either immediately or within 72 hours) after you learn of the breach.
a) Duty to report to Privacy Commission (Art. 33 GDPR) You must notify the Privacy Commission within 72 hours of a breach when that breach is suspected of posing a risk to the rights and freedoms of individuals. You should only report violations where there is a high probability that it will cause harm to the person in question. E.g. identity theft, violation duty of confidentiality, ...
b) Duty to notify the data subject (Art. 34 GDPR) Where the breach could pose a high risk to the rights and freedoms of the individuals concerned, they must be notified without delay. E.g., if unencrypted bank data were stolen. The obligation to report to the data subject does not apply in the following cases:

You have already taken appropriate technical and organizational protection measures with respect to that data (e.g., encryption).
You have subsequently taken measures to ensure that the risk will not recur.
If the reporting requirement would require disproportionate effort (there must be public notice or equally effective similar action).

What is currently applied in your company :(Required)

Someone to is responsible for monitoring and reporting violations

There is a template for reporting violations

There is no procedure yet

Do you need a Data Protection Officer (DPO) ?

The appointment of a DPO is completely new. Some companies will need to appoint a DPO, a kind of privacy prevention advisor. It is a person with both expert and practical knowledge of privacy who should assist the company in monitoring internal compliance with the GDPR (arts. 37-39).

A DPO provides information and advice regarding GDPR obligations to your company.
A DPO monitors GDPR compliance.
A DPO is the central point of contact regarding data protection (both for the company, for the privacy committee and for individuals whose data was processed).
A DPO advises the company regarding the mandatory risk analysis and the results.

When to appoint a DPO

Are you primarily responsible for processing sensitive data (cfr. step 2)?(Required)

Yes

Are you primarily charged with processing personal data that requires regular and systematic observation on a large scale?(Required)

Yes

Do you work with the government?(Required)

Yes

Do you need to conduct a Data Protection Impact Assessment (DPIA) ?

Some companies will have to conduct or have conducted a DPIA, a type of security audit, for certain processing operations.
If the DPIA indicates that the processing of the personal data poses a high risk AND if you cannot mitigate that high risk by measures that are reasonable in view of available technology and implementation costs, you must seek advice from the Privacy Commission and take the necessary measures to mitigate the risk. This obligation applies only to high-risk situations. The assessment of a "high risk must always be done according to the types of personal data, the scope and frequency of processing (Art. 35-36). E.g., when a new technology is implemented or when a profiling operation may have a significant effect on the data subject.

There are three situations in which the GDPR requires this, indicate which one applies :(Required)

Systematically assesses the personal characteristics of individuals by automated means (e.g., profiling) and takes actions based on this assessment that have legal consequences or a similar impact on those individuals (e.g., direct marketing);

Large-scale processing of special categories of personal data or data relating to criminal convictions and offenses;

Systematic and large-scale monitoring of publicly accessible spaces.

None of the above apply

Do you have a register of processing activities ?

Any company processing personal data will have to keep a register of its processing activities (Art. 30).

The register contains the following information:(Required)

Where appropriate, the name and contact details of the (joint) controller, the controller's representative and/or the data protection officer

The processing purposes

On the one hand, a description of the categories of data subjects and, on the other hand, of the categories of personal data

The categories of recipients to whom the personal data have been or will be disclosed (including recipients in third countries or international organizations)

If possible, the intended time periods within which the different categories of data should be deleted

If possible, a general description of technical and organizational security measures

Where applicable, transfers of personal data to a third country or an international organization, including the indication of that third country or international organization and, if necessary, documentation of appropriate safeguards.

There is no register

Finalizing your file

We are committed to protecting the privacy of our customers and are constantly working to comply with the European Union's General Data Protection Regulation (AVG). To ensure that we are fully compliant with GDPR regulations, we are asking all departments within our company to complete this questionnaire and assess whether the appointment of a GDPR EU representative is necessary.

Consent(Required)

I agree to the terms and conditions. (Required)

Consent(Required)

I consent to DPO Associates processing my personal data.(Required)

14897