GDPR anniversary - Time to take your business for a data protection compliance check-up

It’s already the third anniversary of the GDPR!

Here are 10 questions that controllers should consider when self-assessing their compliance. Most of these questions are relevant for processors too!

1. 1. Have you set up and maintained a record/register of processing activities?
2. 2. Are you identifying, on an ongoing basis, lawful bases for all the processing you carry out (including recording consent as appropriate and conducting a balancing test if relying on legitimate interest)?
3. 3. Are you drafting or updating your internal data protection policy and privacy information notice?
4. 4. Are you putting in place processes and procedures to respond to data subjects’ requests (access, update, erasure, etc.) and managing data breaches?
5. 5. Destroying or deleting personal data that is no longer necessary to pursue the purposes for which it has been collected?
6. 6. Implementing appropriate technical and organisational measures to protect personal data (including an information security policy and training for the member of your staff who processes personal data) and are you regularly reviewing the security of your IT environment?
7. 7. Have you entered into a written contract with the processors you use?
8. 8. Do you have documents that you do not need and have you conducted data protection impact assessments (DPIA)?
9. 9. Have you appointed a DPO?
10. 10. Are you ensuring all transfers of personal data are made under appropriate safeguards and are you taking appropriate measures further to the Schrems II case?

For any questions please contact the ICT, IP, media and data protection team.

Linda Funck, Partner | Tel: +352 44 66 44 5164 | E-mail: lindafunck@elvingerhoss.lu
Gary Cywie, Partner | Tel: +352 44 66 44 5164 | E-mail: garycywie@elvingerhoss.lu