The Institute of Continuous Professional Training and Education (ICPTE) offers an extensive variety of Self-Paced Online and Live Online seminars created by Professional and qualified Instructors with years of experience in their field.
The ICPTE platform offers the flexibility to watch online self-paced seminars at Your own convenience, at Your own pace, in Your own time and place. Start watching a seminar today and complete it at Your own time. You can have access from anywhere. All self-paced online seminars are in the form of PowerPoint presentations and a number of them includes video.
Key requirements to comply with the GDPR obligations
Introduction
The General Data Protection Regulation (GDPR) constitutes a comprehensive legal framework established by the European Union (EU) to regulate the processing of personal data and strengthen the protection of individuals’ fundamental rights to privacy and data protection. It entered into application on 25/05/2018, replacing the Data Protection Directive 95/46/EC. The GDPR sought to harmonize personal data protection legislation across EU Member States while responding to the increasing volume and complexity of personal data processing associated with digital technologies and the global economy.
The territorial scope of the GDPR is extensive. It applies not only to organisations established within the EU but, under specified circumstances, also to organizations located outside the EU. In particular, the GDPR may apply where an organization offers goods or services to individuals in the EU or monitors their behaviour within the EU. Consequently, the GDPR has significant implications for multinational corporations, online platforms, public authorities, and other organizations that process personal data relating to individuals in the European Economic Area (EEA).
A central concept within the GDPR is personal data, which refers to any information relating to an identified or identifiable natural person. This may include names, identification numbers, contact information, location data, online identifiers, and other information capable of being linked to an individual. The GDPR provides additional safeguards for special categories of personal data, including information concerning health, genetic and biometric characteristics, political opinions, religious or philosophical beliefs, and trade-union membership. The processing of such sensitive information is generally subject to stricter conditions.
Comply with the GDPR fundamental principles
The GDPR establishes several fundamental principles governing the processing of personal data. These include lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability.
Organizations are therefore expected to collect and process personal data for specified and legitimate purpose(s), limit the collection of personal data to what is necessary, maintain its accuracy and retain it only for an appropriate period. Furthermore, appropriate technical and organizational security measures must be implemented to ensure the security and confidentiality of personal data.
• Lawfulness, fairness and transparency, meaning that people should know how and why their personal data is being used (processed).
• Purpose limitation, which means data should only be collected for specific and legitimate purpose(s).
• Data minimisation, meaning that companies should only collect the personal data they actually need.
• Accuracy, ensuring that personal data is correct and kept up to date (inaccurate personal data should be erased or rectified).
• Storage limitation, meaning that personal data should not be kept longer than is needed for the purposes for which the personal data is processed.
• Integrity and confidentiality, which require companies to protect personal data from unauthorised or unlawful processing, accidental loss, destruction or damage (by implementing appropriate security measures).
• Accountability, which means companies must be able to demonstrate that they comply with all the GDPR principles.
GDPR grants a set of rights to Data Subjects (individuals)
Data Subjects have the right to obtain confirmation as to whether their personal data is being processed and, where applicable, to access that information. They may also request the rectification of inaccurate personal data and, under certain conditions, the erasure of their personal data, commonly referred to as the “right to be forgotten.” In addition, Data Subjects’ rights include the restriction of processing, objection to certain forms of processing, and personal data portability in circumstances established by the GDPR.
These Data Subjects’ rights are intended to increase transparency and strengthen individuals’ control over their personal information.
Organisations should develop and implement the necessary procedures to meet Data Subjects within the deadlines provided in GDPR.
Process personal data only on a legal basis
A key requirement of GDPR is the processing of personal data on, at least, a legal basis. The GDPR (Article 6), provides for six lawful bases for processing personal data. These legal bases are the processing of personal data when a data subject’s Consent is received, for the performance of a contract, for compliance with a legal obligation, for protection of vital interests of a data subject, to perform a task carried out in the public interest and for the legitimate interests of the organisation.
Organizations must establish a valid legal basis before processing personal data. Therefore, an organisation should assess and decide the most appropriate legal basis/bases to use, in accordance with the purpose for processing personal data and the relationship with individuals. If no lawful basis applies to the organisation’s personal data processing activities, then the processing will be unlawful and in breach of the first principle of GDPR which provides that personal data shall be processed lawfully, fairly and in a transparent manner.
How to comply with GDPR specific requirements
In addition to ensuring compliance with the GDPR principles and establishing a lawful basis for the processing of personal data, an effective GDPR compliance programme should ensure that an organisation:
• Developed and implements procedures to meet the Data Subjects rights (comply with Data Subjects rights);
• Can identify and respond to Personal Data Breaches (ensure personal data breach procedures are in place, and employees know how to identify and respond to various incidents);
• Has signed a contract or other legal act with a “Processors” (when a “Processor” is appointed);
• Implements security measures from the very start of a processing activity and limit the processing of personal data only to what is needed (Implement privacy by design and by default);
• Performs a Data Protection Impact Assessments (DPIAs) when a processing activity may result to a high risk for Data Subjects.
• Transfers personal data to third countries only when the provisions of Chapter V of GDPR are met;
An organisation is responsible to keep proper records in order to be able to demonstrate accountability and compliance with GDPR requirements.
Conclusion
Every organisation that processes personal data should ensure that it complies with the GDPR obligations. Non-compliance with the GDPR obligations can result in significant legal, financial, and reputational consequences. Organizations are expected to incorporate personal data protection into their operational processes, policies, information systems, and organizational decision-making. The GDPR requirements encourage a continuous approach to compliance rather than treating personal data protection as a one-time administrative obligation.
Looking to enhance your knowledge and learn new skills on GDPR?
▶️ Click HERE to find online self-paced seminars on GDPR topics.
