GDPR

The ‘GDPR Section’ reinforces your organization’s commitment to protecting personal data and complying with the General Data Protection Regulation (GDPR) and other relevant laws. To ensure compliance, the outlined processes must be accurately reflected in the Privacy Policy Framework, which can be accessed in the Compleye Online Templates Section, ensuring GDPR requirements are properly documented, communicated, and understood across the organization.  

Along with the Privacy Policy Framework, the GDPR section enables you to: 

• Provide an overview of the legal basis for data processing. 

• Maintain a registry of data protection-related documents. 

• Provide a registry for handling data subject requests, such as access, rectification, or deletion of personal data, in a timely and compliant manner. 

• Provide a registry for reporting data breaches promptly, as required by GDPR. 

• Offer an overview of the data processing agreements (DPAs) you have in place with third-party vendors, ensuring that data protection obligations are properly shared and enforced across your supply chain. 

LEGAL BASIS
Under GDPR, organizations must establish a lawful basis for processing personal data. Article 6 of the GDPR outlines six legal bases for processing: 

• Consent: Obtaining explicit permission from the data subject to process their personal data. This consent must be specific, informed, and unambiguous. 

• Contractual Necessity: Processing personal data is essential to fulfill contractual obligations with the data subject or to take steps at their request prior to entering into a contract. 

• Legal Obligation: Processing is necessary for compliance with a legal obligation to which the data controller is subject. 

• Vital Interests: Processing is necessary to protect the vital interests of the data subject or another individual, such as in life-threatening situations. 

• Public Task: Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. 

• Legitimate Interests: Processing is necessary for the purposes of legitimate interests pursued by the data controller or a third party, provided these interests are not overridden by the data subject’s rights and freedoms. 

It’s important to note that a single data processing activity may rely on multiple legal bases. For example, processing employment data may be justified by both contractual necessity and legal obligation. Additionally, when relying on consent as the legal basis, data subjects must have the option to withdraw their consent at any time, and the process to do so should be as easy as giving it. 

After identifying your data sources and establishing the legal bases for processing, it’s essential to define your organization’s role in data processing. GDPR outlines specific roles and responsibilities for entities involved in processing personal data: 

Data Controller: An organization that determines the purposes and means of processing personal data. If your company decides ‘why’ and ‘how’ personal data is processed, it is considered the data controller. Employees processing personal data within your organization do so to fulfill tasks assigned by the data controller. 

Joint Controllers: When two or more organizations jointly determine the purposes and means of processing personal data, they are regarded as joint controllers. Joint controllers must establish an arrangement outlining their respective responsibilities for complying with GDPR requirements. The key aspects of this arrangement must be communicated to the individuals whose data is being processed. 

Data Processor: An organization that processes personal data on behalf of the data controller. Data processors are typically third parties external to the company. However, within corporate groups, one entity may act as a processor for another. 

Finally, document Data Protection Authorities (DPAs): Each country within the European Economic Area (EEA) has a designated DPA responsible for overseeing data protection laws and ensuring compliance. For a comprehensive list of DPAs across Europe, refer to the European Commission’s directory. 

USER DOCUMENTATION

Maintaining up-to-date End-User Documentation is essential for ensuring transparency, building trust, and achieving compliance with data protection regulations such as the GDPR. This documentation serves as a vital resource for informing consumers—who are the primary subjects of the GDPR—about how their personal data is collected, used, and protected. 

Types of End-User Documentation 

1. Internal Privacy Policy: Tailored for internal team members, this policy outlines the organization’s approach to data protection, detailing how employee and operational data are managed. 

1. External Privacy Policy: Directed towards end-users, this policy explains the privacy practices related to the products or services offered, ensuring users understand how their data is handled. 

1. Cookie Policy: Essential for websites, this policy clarifies the use of cookies, explaining their purpose and ensuring compliance with regulations requiring user consent for cookie usage. 

1. Terms of Use: These are the rules and guidelines that users must agree to in order to use the organization’s products or services, often including clauses related to data processing and privacy. 

Depending on the nature of your products or services, additional documentation may be necessary to fully inform users about data processing activities. 

Checklist for External Privacy Policy 

To ensure your External Privacy Policy is compliant with GDPR, consider including the following elements: 

• Provide clear information about your organization’s identity, including contact details. 

• Explain why personal data is collected and the legal grounds for processing it, such as user consent or contractual necessity. 

• Specify the types of personal data gathered from users. 

•  Disclose any third parties with whom personal data may be shared and the reasons for such sharing. 

•  State how long personal data will be stored and the criteria used to determine this period. 

•  Describe the security protocols in place to protect personal data from unauthorized access or breaches. 

•  Inform users of their rights to access, correct, delete, and transfer their personal data, as well as their right to withdraw consent at any time. 

• Outline the process for users to file complaints regarding data processing activities. 

• Detail how consent is obtained from users, ensuring it is informed, specific, and freely given 

Checklist for Cookie Policy 

To ensure your Cookie Policy is compliant with GDPR and ePrivacy Directive, consider including the following elements: 

• Provide a brief, user-friendly explanation of cookies and their function. Example: 
  “Cookies are small text files stored on your device that help improve website functionality, analyze traffic, and personalize user experiences.” 

• Clearly state the purpose of cookies on your website, such as: 

Essential cookies – Necessary for website functionality. 

Performance cookies – Help track website usage and improve user experience. 

Functionality cookies – Remember user preferences (e.g., language settings). 

Targeting/Advertising cookies – Used for personalized ads and tracking across websites. 

• Provide a categorized table or list outlining:Cookie name, Purpose (e.g., session management, analytics, advertising), Duration (how long the cookie remains on the user’s device), Third-party involvement (if applicable) 

• If you use third-party services (e.g., Google Analytics, Facebook Pixel, or marketing platforms), mention them explicitly. Users should know if their data is shared with external parties. 

• To comply with GDPR and ePrivacy Directive, users must have the ability to accept or reject non-essential cookies via a consent banner, manage cookie preferences at any time through a settings page and withdraw consent as easily as they gave it. 

• Make sure your policy complies with relevant privacy laws: GDPR (EU/EEA) – Requires clear consent before storing non-essential cookies and ePrivacy Directive (EU Cookie Law) – Covers cookie tracking and consent requirements. 

• Your Cookie Policy should be accessible from your Privacy Policy and website footer. Ensure consistency between both policies. 

• Regularly review and update your Cookie Policy to reflect any changes in your use of cookies or legal requirements. Adding a ‘Last Updated’ date improves transparency. 

• To ensure your website’s compliance with the General Data Protection Regulation (GDPR) regarding cookie usage and data collection, consider utilizing the following tools: 

• Cookiebot: This cloud-driven solution automatically controls cookies and trackers, enabling full GDPR/ePrivacy and CCPA compliance for websites. Cookiebot 

• 2GDPR: A free tool that audits website cookies, online tracking, and HTTPS usage, providing reports on where GDPR cookie consent or SSL is required.  

• ECOMPLY.io: Delivers GDPR assessments with step-by-step plans toward creating policies that ensure compliance, saving preparation and documentation time. 

To ensure your organization’s compliance, it’s recommended to use the Checklist for Privacy and Cookie Policy, which can be accessed in the Compleye Online Templates Section, that cross-checks the content of your Privacy Policies and Cookie Notices for compliance and identifies any shortcomings. 

USER GDPR RIGHTS REQUESTS

Under the GDPR individuals (data subjects) have specific rights concerning their personal data. These rights include the ability to withdraw consent, access, correct, delete, and transfer their data (data portability). Organizations must establish clear procedures to handle these requests efficiently and ensure compliance with GDPR. 

The User GDPR Rights Request Section serves as a registry where all received data subject rights requests should be logged, documented, and tracked for future reference. 

Who is Responsible? 

The responsibility for handling data subject rights primarily rests with the data controller—the entity that determines the purposes and means of processing personal data. If your role is that of a data processor, providing services such as Business-to-Business (B2B) solutions, you may not be directly responsible for managing data subject rights requests. Instead, your customers, acting as data controllers, are responsible for managing these requests. 

However, as a data processor, you are obligated to assist your customers in fulfilling these requests when required. This assistance is typically outlined in the Data Processing Agreement (DPA) between you and your customer. Therefore, it’s essential to ensure that your systems and processes can support the execution of data subject rights as requested by your customers. This includes promptly notifying and assisting the customer upon receiving such requests. 

To handle GDPR data subject requests, your organization should: 

• Familiarize yourself with the specific data rights outlined in GDPR, including access, rectification, erasure, restriction, portability, and objection. 

• Ensure that your Privacy Policy Framework includes a defined Data Rights Request Handling Procedure. 

• Train your employees on how to respond to data rights requests and define who is responsible for handling such requests internally. 

• Keep a record of all data rights requests and their resolution to demonstrate compliance with GDPR in case of an audit. 

What to register: 

• Request from (name of the End-User) 
• Project (or customer) 
• Request Date 
• The GDPR Right type (drop down list) 
• Closed in progress (to remind you) 
• End date (fill in when you close) 
• Link to tech job (link to ticket of TechTeam, with evidence of eg deletion) 
• Make use of extra fields if needed (add evidence) 

DATA BREACHES

This section serves as a place to maintain the registry of reported data breaches. It is essential to define what constitutes a data breach and establish clear processes for reporting and handling such incidents. Under the GDPR, a data breach is defined as a security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data. This encompasses various scenarios, including: 

• Loss of Personal Data: Accidental deletion or misplacement of data storage devices. 

• Unauthorized Access: Access to personal data by individuals without proper authorization. 

• Data Alteration: Unauthorized modification of personal data. 

• Data Disclosure: Accidental or unlawful sharing of personal data with unauthorized parties. 

It’s important to note that this definition can be expanded or modified based on the specific services your organization provides and the requirements of your customers.  

Reporting and Handling Data Breaches 

Establishing clear processes for reporting and managing data breaches is vital. The GDPR mandates that data controllers notify the relevant Data Protection Authority (DPA) of a personal data breach without undue delay, and no later than 72 hours after becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals.  

If the breach is likely to result in a high risk to individuals’ rights and freedoms, affected individuals must also be informed without undue delay. This timely communication allows individuals to take necessary precautions to protect themselves from potential adverse effects. 

Key Steps in Data Breach Reporting: 

Step 1: Understanding Data Breach Definition: It’s important that your organization clearly understands the definition of a data breach. You can consult the link provided by the Dutch Data Protection Authority (or use similar resources from other EU countries) to get detailed guidelines on data breach notifications: Dutch Data Protection Authority Data Breach Notification Guidelines. 

Step 2: Internal Data Breach Reporting: If the data breach concerns data processed in the capacity of a data processor, it is critical to notify the data controller (your customer) of the breach, detailing the scope and timing of the notification. These specifics should be clearly outlined in the contract executed with the customer. 

Step 3: Role of Data Protection Officer/ Privacy Officer: All data breaches must be reported to the appointed Data Protection Officer (DPO) or Privacy Officer (PO) for evaluation. This ensures a centralized and effective response. It is essential to have clear communication channels and protocols in place to ensure swift action. 

Step 4: Escalating to Senior Leadership: In the event of a data breach, C-level management must always be notified. Data breaches can have serious implications for the organization, both legally and reputationally. Senior leadership will need to assess the business impact, and external communication may be necessary. 

Step 5: Data Breach Handling Steps: The Data Breach Reporting Template, which can be accessed in the Compleye Online Templates Section, provides a structured approach and steps to follow in case of a data breach. This template should be integrated into your internal systems to ensure structured and compliant reporting when a data breach occurs. 

DPA OVERVIEW

A Data Processing Agreement (DPA) is a critical document that governs how data is handled between your organization and third parties such as customers, suppliers, or partners. You may store DPAs in Compleye Online as they are the only contracts related to data protection that need to be maintained within the platform. Unlike other commercial contracts, DPAs focus solely on the agreed-upon data protection terms and do not contain other confidential or commerical related information. 

Best Practices for Managing DPAs: 

• It is a good practice to specify in your DPAs that they will automatically expire when the commercial contract (such as an MSA or SLA) between the parties expires. This eliminates the need for separately tracking DPA end dates, simplifying the process for your team. 

• For smaller B2B companies, DPAs can often be incorporated into the broader commercial contracts (MSA/SLA) with customers or suppliers. In such cases, it may not be necessary to add a separate DPA in this section of the platform. However, if there are unique privacy or security measures specifically agreed upon with a customer or supplier, those should be noted either in the ‘Global Impact Section’ or within the specific DPA document itself. 

•  If your organization enters into standalone DPAs with customers, partners, or suppliers, you should file them here to track each agreement’s terms. This will help ensure that you have clear records of each DPA, including any special provisions or clauses. For each DPA, you can keep track of important dates, clauses, and details to ensure proper compliance and documentation. 

• To streamline the process, consider using a standardized DPA template for various types of agreements, such as those with suppliers, customers, or partners. This will allow you to manage multiple DPAs efficiently.  

When entering a new DPA into Compleye Online, document the following key details: 

• Type of DPA: Specify the type of agreement (e.g., supplier, partner, customer). 

• Contract Party: The name of the other party involved in the DPA. 

• Remarks: Add any special clauses or deviations from the standard template that are included in the DPA. 

• Date Signed: The closing date when the agreement was signed. 

• Attach the DPA: Upload the actual DPA document as evidence for easy reference. 

• Use Extra Fields: If necessary, use additional fields to track any special terms, renewal dates, or other important information related to each agreement. 

==> Annual Privacy Compliance Review 

During the annual Privacy Review, and in accordance with the established Operational and Planning Control (OPC) procedures, please refer to the standard OPC Overview Template available in the Compleye Online Templates Section. Your organization must review and, if necessary, enhance its compliance with GDPR and other relevant privacy laws and regulations to ensure continuous adherence to legal and regulatory requirements. This process includes the following:  

• Privacy Assessment: A structured privacy assessment must be reviewed and, if the scope of data processing has changed, re-conducted using a predefined set of questions aligned with GDPR requirements. 

• Privacy Framework Policy: Ensuring alignment with current legal standards. 

• Record of Processing Activities (ROPA): Reviewing updates in data processing activities. 

• Data Processing Agreements (DPAs): Verifying compliance with contractual obligations and reviewing the existing template for accuracy and alignment with current legal requirements.

• Privacy and Cookie Policies: Ensuring website policies reflect current legal requirements. 

• Data Breach Processes: Assessing incident response and reporting mechanisms. 

• Data Subject Access Rights (DSARs): Evaluating procedures for handling user data requests. 

• Data Retention Schedules: Reviewing and updating retention policies in line with regulations. 

Legal Basis – Add New

User Documentation – Add new

User GDPR Rights Request – Add new

Data Breaches – Add new

DPA Overview – Add new