Article 35

Creation of a Data Protection Impact Assessment (DPIA)s

• If you are using "new technologies" which process personal data which is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall carry out an assessment of the protection of personal data.
• DPIA is many regards similar to a Privacy Impact Assessment (PIA) (according to many legal experts and data protection authorities)
• Use this situation to create a clear data ownership chart of your GDPR bound solutions: What, Why, Who, Where, Data-life-cycle etc
• Make sure that it's crystal clear who is responsible and for what
• Show the complete info chain of your customers personal data: creation, update and deletion (expiration)
• Remember to keep your DPIA up-to-date. Mark down who has checked it, when and what was changed
• Benefits From DPIA / PIA [ * ]
• Helps to avoid costly or embarrassing privacy mistakes
• A way to gain the public's trust and confidence
• Demonstrates to employees, contractors, customers, citizens that the organization takes privacy seriously
• An early warning system, a way to detect privacy problems, build safeguards before, not after, heavy investment –Fix privacy problems now, not later
• Enhances informed decision-making
• Provides evidence that an organization attempted to prevent privacy risks (reduce liability, negative publicity, damage to reputation)

The assessment shall contain at least:

a systematic description of the envisaged processing operations and the purposes of the processing, including, where applicable, the legitimate interest pursued by the controller;

an assessment of the necessity and proportionality of the processing operations in relation to the purposes;

an assessment of the risks to the rights and freedoms of data subjects referred to in paragraph 1; and

the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Regulation taking into account the rights and legitimate interests of data subjects and other persons concerned.

Article 7
Article 8

Conditions for consent
Conditions applicable to child's consent in relation to information society services

• It must be as easy for the customer to withdraw their consent as it is to give it.
• Consent for children (data subjects below 16 years) must be given by the child’s parent or custodian
• The controller must be able to demonstrate that the customer (data subject) has consented to processing of his or her personal data
• Example: you must be able to prove that your user has ticked a "Yes I'm OK with XYZ"-tick box (NOTE: this box cannot be pre-ticked, the data subject or custodian must tick or set it)

Article 5

Principles relating to processing of personal data

Personal data shall be:

• Lawfulness, Fairness and Transparency - Processed in a lawfully and in a transparent manner
• Purpose limitation - Limited to a specified, explicit and legitimate purposes only
• Data minimisation - Limited to what data is actually needed to complete the task
• Accuracy - Accurate and up to date
• Storage limitation - Kept for no longer than is necessary for the purposes for which the personal data are processed
• Accountability - The controller shall be responsible for, and be able to demonstrate compliance with the rules mentioned above

Article 16

Right to rectification

• The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her.

Article 18

Right to restriction of processing

• The data subject has the right to obtain from the controller restriction of processing his/her personal data based on the accuracy, unlawful processing or that the controller no longer needs the personal data.

Article 25

Data protection by design and by default

• Pseudonymisation: use encryption when processing personal data to reduce the risk to the rights and freedoms of natural persons
• All privacy settings should be set to high level by default.
• The same "privacy by default" mental-mode should be built in to all new business processes as well

Article 37

Data Protection Officer (PDO)

• Simplifies bigger multinationals bureaucratic communication needs with the Data Protection Authorities (PDA) via mandatory Internal record keeping
• DPO appointment is mandatory for public authority or those controllers whose regular core activities consist of processing large scale data and / or of special categories of data or data relating to criminal convictions and offenses
• The PDO shall be designated on the basis of professional qualities and expert knowledge of data protection law and practices
• The PDO may be a consultant or staff member of the controller or processor.
• The PDO contact data must communicate to the supervisory authority.

WARNING: Legal risks to being a DPO: Before assuming DPO role - Check your rights & liabilities: Check (1) your companies policies (2) employers insurance policies (3) local countries laws: iapp: In some countries, DPOs – or their equivalent under local law – may be held personally liable for failing to comply with local privacy law.

Article 28

Controller and processor
Processor
"Data Processing Agreement"

• A legal data processing contract between the processor and controller
• Please see Definition of data controller and Definition of data processor
• Make sure that your company has a up-to-date data processing contract with all of your clients (controllers) which complies with Article 28
• Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees will meet the requirements of this Regulation
• Processing by a processor shall be governed by a contract or other legal act under Union or Member State law

That contract or other legal act shall stipulate, in particular, that the processor:

1. processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest;
2. ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
3. takes all measures required pursuant to Article 32;
4. respects the conditions referred to in paragraphs 2 and 4 for engaging another processor;
5. taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III;
6. assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 taking into account the nature of processing and the information available to the processor;
7. at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data;
8. makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller.