How long will you process the data?

[suchona.kani.z]

The company must not condition the use of the application on consent (typical practice with e-books or various calculators). Do not use consent in cases where it can be assumed that the subject does not understand the essence of consent - i.e. in the case of children, seniors or people with reduced decision-making capacity.

As part of the consent, the user must find out the following information:

To whom the data is provided (i.e. identification of your company)
What data do you collect about him/her?
Purpose of processing
Whether you will transfer the data to other processors and who these processors are and whether you will transfer the data outside the EU
How to withdraw consent
What rights does the user have?
DOWNLOAD CHECKLIST

How to be prepared?
Step 1: Conduct an internal audit
To know what you need to fix or tweak, you need to know what overseas chinese in uk data data you are processing and where. So clean up your data . You don't need expensive lawyers and days full of analysis (unless you are a corporation).

Use this questionnaire from the Internet Development Association. The output will be a completely simple Excel spreadsheet that maps out what data you are collecting. You can find a sample of such a spreadsheet here .

GDPR requires a Data Protection Impact Assessment . However, this is only required for companies that process sensitive data or that “ systematically and extensively evaluate personal aspects relating to natural persons, unless such evaluation is based on automated processing (including profiling ).” In practice, this applies to very few people.

If you have to carry out an impact assessment, you are probably also required to have a Data Protection Officer , who will ensure compliance with all legislation. More about what the officer must do .

Step 2: analyze the risks
Risk analysis will add a few columns to your internal audit. You will ask how much risk a specific piece of personal data poses to the entity.