GDPR Compliance Service

Yes. It covers any company or organisation that processes personal data (whether of its employees, customers and/or suppliers), regardless of size or the volume of data it handles.

This is a good starting point, but the GDPR establishes new obligations. Therefore, you will have to review them and adapt your privacy policies to the new Regulation.

Yes. Also, it’s important that your suppliers comply with the GDPR and that you work with trustworthy brands.

Yes. All companies that offer goods and services and handle data of EU citizens must comply with the regulation, even if you are based outside the EU.

It depends if the data subject has given you their express consent to transfer their data. Have you informed them of the risks involved in transferring their data to a country that lacks adequate safeguards?

Also, do you need to communicate the information in order to perform or execute a contract between your company and the data subject? If not, do you have the authorization of the Spanish Data Protection Agency?

This means it is up to the company to decide what security measures are in place to protect the data and privacy of individuals. The business must also show that these measures are effective and comply with the regulation.

The new regulation requires that data should be collected for a specific purpose and only a minimum amount of personal data is necessary for legitimate processing purposes. You should analyse what measures, both technical and organisational, your company has in place to avoid jeopardising the rights and freedoms of data subjects.

The person who is receiving the advertising or promotions must have given their express consent. It is no longer sufficient, for example, for you to have a pre-ticked box in which they give their consent.

Therefore, you must check that all database records are aware of what and how their data will be used. You need to ensure that they have given you clear approval. This requires a review of all the information clauses that have been used up to now.

No, it is no longer obligatory.

However, there must be a Register of Processing Activities, which is documents who is responsible for the data and makes an inventory of the type of data, how it is processed and protected.

If your company has more than 250 employees or processes special categories of data, like health or ideology, this register is mandatory. Smaller businesses don’t need to do this but it is recommended as it demonstrates that you comply with the GDPR.

This person is designated by the company, internally or externally, to supervise, coordinate and disseminate your data protection policy. In addition, they liaise with the Spanish Data Protection Agency.

Their appointment is only mandatory in certain cases, like: if you are a public body or company (except the courts); if your company conducts regular and systematic observation of people on a large scale, such as internet tracking, location of users through apps, profiling, scoring, loyalty programmes or if you handle large-scale data on people on sensitive subjects, like health, ideology and sexual orientation.