GDPR Implementation

For what purpose do you collect personal data?

In essence, the GDPR says there is less chance of the data being used for the wrong purposes, if fewer are collected. At present, it is strictly forbidden to collect personal data at random and in waves, to create a database and use it for your own purposes or, worse, given the conditions under the law, to sell them. Instead, you need to have a well-crafted plan for how you intend to use people’s data and justify them by using legal arguments.

Currently, consent is the most common legal reason, but the GDPR tightens the rules for obtaining and retaining it, so organizations should only use it unless other reasons apply. There are detailed rules for asking for consent, which varies depending on what type of information you want and from whom you want it. Sensitive personal data requires explicit consent and there are separate requirements for obtaining consent from children.

After you have formed a clear picture of the data collected and why you do it, you must inform the data subjects through the privacy policy.

Policies should be written in clear language, explaining how data is collected, where they are stored, for how long they are stored – because the GDPR states that you can only hold them for a definite period – and what rights people have to give approval themselves.

These rights include:

• Access Right: Individuals must have the right to submit a request to receive a copy of the personal data held by any entity.
• Right to Rectification: If the information held by an organization is inaccurate or incomplete, natural persons may request their updating.
• Right to Delete: In certain circumstances, individuals may request that the organization deletes their personal data.
• Right to Restrict: As an alternative to deleting data, there is a possibility that individuals would prefer and that is to simply restrict processing.

Cookies are subject to GDPR only if they concern personal data. Many cookies fall into this category, such as those used for analytics, advertising and other services.

You must consider all cookies that contain personal data and state whether there is a legitimate and specific reason for using them. If there is a reason, then your website should clarify this.

Any company must have written evidence to justify data collection practices. In the event of an infringement, an investigation is conducted in which the requirements of the regulation are analysed.