GDPR compliance is a legal advisory service of the Alina Szilaghi law office, which advises on personal data protection and related areas such as IT law.
GDPR is the European Union’s General Data Protection Regulation (Regulation (EU) 2016/679), which has applied since 25 May 2018.
The Regulation gives individuals a set of rights and places corresponding obligations on legal persons that control or process personal data. Personal data means any data that can identify a person, including name, personal identification number or address. Some data — such as health data, criminal records or membership of a disadvantaged group — are sensitive and enjoy greater protection.
The obligations affect everyone who processes such data, but especially those who process sensitive data (clinics, pharmacies, schools, notaries, lawyers and so on) or who process data by the nature of their business (recruitment agencies, online shops and so on).
The obligations are demanding, because fines for the most serious breaches can reach €20,000,000 or 4% of total worldwide annual turnover, whichever is higher (GDPR art. 83).
What you need to do depends on the nature of your business, the type of data collected and how it is used and processed. There is no one-size-fits-all answer. Some organisations must appoint a data protection officer (DPO), others need not. Some processing requires the person’s prior consent, other processing does not. So the first step is an audit of how the Regulation affects the way you collect, store or use personal data, followed by the necessary measures. Some of these will cost money, but far less than the fines.
The Alina Szilaghi law office first audits your company’s activity to determine exactly which obligations apply, and then advises on and prepares the documents you need:
- Privacy policy
- Terms and conditions
- Confidentiality agreement
- Data protection policy — security measures and risk management plan
- Consent form
- Register of complaints and reports
- Register of security breaches and remedies taken
- Data protection impact assessment (DPIA)
- Notice of measures taken after an incident to remove or reduce its effects
- Personal data breach notification
- Register of data subject requests
- Register of third parties
- Notification to the supervisory authority
- Notice to data subjects of data held
- Staff training record
- Audit report
- Contract with the DPO / job description
- Record of processing activities
- Audit trail document
Page updated . The information on this website is general and is not legal advice on any specific matter.