What does your organisation need to do?
For this new legislation, every organisation has to take stock properly of the steps needed to comply with the GDPR. Within the organisation there has to be a clear picture of which personal data is collected, for what purpose that happens, whether that data is stored securely and whether it is also deleted in good time. The General Data Protection Regulation is not limited to your customers' data; employee data falls under the new legislation too.
Across the whole organisation you will therefore have to look at what happens to personal data, who can view that data and who it is shared with. In some cases you even have to appoint an employee as data protection officer.
Where to start?
As an organisation you can get going yourself with the step-by-step plan drawn up by the Dutch Data Protection Authority. An important part of it is ‘Step 8: Processor agreements’. As your online partner, Digital Impact takes various measures to protect and process data as well as possible, but a processor agreement does have to be in place. Digital Impact arranges that processor agreement through the Service Level Agreement (SLA).
The GDPR check
If your organisation had everything in order on 25 May 2018, you do not have to worry about any fines. Your organisation then has the following:
- A correct cookie/privacy notice
- Analytics tools configured correctly
- Measures within the organisation to protect data
- Processor agreements with every party that processes data for the organisation
- Privacy by design: asking users for consent explicitly
- A clear overview of the personal data that is collected and for what purpose
- A clear procedure for reporting data breaches
- Recorded consent from users to collect and process data