Rules for business and organisations

Find out what your organisation must do to comply with EU data protection rules and learn how you can help citizens exercising their rights under the regulation.

Application of the regulation

Who does the data protection law apply to?
Do the rules apply to SMEs?
Do the data protection rules apply to data about a company?

Principles of the GDPR

What data can we process and under which conditions?
Purpose of data processing
How much data can be collected?
For how long can data be kept and is it necessary to update it?
What information must be given to individuals whose data is collected?
Overview of principles

Public administrations and data protection

What are the main aspects of the General Data Protection Regulation (GDPR) that a public administration should be aware of?
How should requests from individuals be dealt with?
What if a public administration fails to comply with the data protection rules?

Legal grounds for processing data

Grounds for processing
Sensitive data
Are there any specific safeguards for data about children?
Can data received from a third party be used for marketing?

Obligations

Controller/processor
Are the obligations the same regardless of the amount of data my company/organisation handles?
What does data protection ‘by design’ and ‘by default’ mean?
What is a data breach and what do we have to do in case of a data breach?
When is a Data Protection Impact Assessment (DPIA) required?
Data Protection Officers
What rules apply if my organisation transfers data outside the EU?
How can I demonstrate that my organisation is compliant with the GDPR?

Dealing with citizens

How should requests from individuals exercising their data protection rights be dealt with?
What personal data and information can an individual access on request?
Do we always have to delete personal data if a person asks?
What happens if someone objects to my company processing their personal data?
Can individuals ask to have their data transferred to another organisation?
Are there restrictions on the use of automated decision-making?

Enforcement and sanctions

Enforcement
Sanctions

Disclaimer

Library of related documents

Library of related documents