If the incident could result in data subjects being exposed to serious risks, your organization must notify the regulatory authority if possible within 72 hours of discovery. In some cases, the registered must also be informed of the risks. This is regulated in Articles 33 and 34 of the Data Protection Regulation. In connection ...läs mer

The personal data controller is the natural or legal person, public authority, institution or other body that alone or together with others determines the purposes and means for the processing of personal data.

It is the person in charge of personal data who must ensure that the GDPR is followed within the organization.

When personal data is to be processed, the rules for personal data processing in the GDPR must be followed. The starting point is that all personal data processing is prohibited if it does not have a legal basis. When the legal basis for personal data processing is determined and documented, other requirements of the ...läs mer

Yes, handling children's personal data requires special treatment. According to the Data Protection Regulation, children cannot themselves consent to the storage and use of their personal data, instead the guardians' consent is required. When you inform children about things related to the Data Protection Regulation, you must do it in such a simple way ...läs mer

All information that can be directly or indirectly linked to a living natural person is considered personal data. Even images (photos) and audio recordings of individuals can be personal data, even if no names are mentioned. Encrypted data and various types of electronic identities, such as IP numbers and user accounts, count as personal ...läs mer

Both yes and no: the data protection regulation does not always apply to private individuals. The Data Protection Regulation does not apply to private individuals when it comes to things that are of a purely private nature (or that are related to the person's household). But if the person, for example, has a blog ...läs mer

The most senior decision makers within your organization should be familiar with the Data Protection Regulation. Above all, they should inform themselves about the requirements that the Data Protection Regulation places on the organization, and what consequences there may be from not complying with the law.

Before starting a new treatment that involves major integrity risks, you must do a consequence assessment. Impact assessments are described in Article 35 of the Data Protection Regulation.

The most important rights of registered persons: right to information about the treatment right to access their personal data right to have incorrect information corrected right to have their personal data deleted right to object to the use of the personal data right to restriction of treatment rights linked to automated decision-making and profiling ...läs mer