Key points:

• Businesses must comply with GDPR requirements regarding the protection of personal data.
• They must ensure data security in order to prevent the risk of data leaks, hacking or misuse.
• The implementation of data governance structures the policy for managing and processing information flows.
• This management is a major challenge for businesses in the face of digital and technological development.

In an era characterised by an explosion in data volumes, businesses are required to implement an effective privacy and data management policy. They are obliged to comply with the GDPR, which aims to regulate and secure the processing of personal data. Reveals supports you in understanding this regulatory framework, identifying the key issues and implementing practical measures tailored to your business.

What is data privacy ?

Data privacy refers to all measures designed to protect personal information collected by an organisation, whilst ensuring that individuals retain control over its use. It helps prevent any unauthorised access, use or disclosure.

Personal data refers to any information that allows a natural person to be identified, either directly or indirectly. This may include their first and last names, telephone number, email address, online credentials, national insurance number or IP address.

Protecting this information is a major concern, as misuse can have serious consequences: unsolicited marketing, discrimination or even identity theft.

In this context, individuals must be able to retain control over their information. They have the right to be informed clearly and transparently about how their data is collected, stored and processed.

For their part, organisations are obliged to put in place protocols and technical and organisational measures to ensure information security and to comply with the principles of transparency and security.

What is the regulatory framework for the personal data management policy ?

The GDPR : the key reference

The General Data Protection Regulation (GDPR), which came into force in May 2018, harmonises practices relating to the processing of personal data at European level. Its aim is to strengthen individuals’ rights, hold data controllers accountable and provide a regulatory framework for their activities. This regulation applies to all private and public organisations that collect and process personal data, including businesses.

The GDPR is based on six key principles from which other regulations derive :

• Transparency. Individuals must be informed of how their information is processed and of their rights regarding such processing (correction, access, erasure, etc.).
• Purpose. Information must be collected for legitimate purposes of the organisation (human resources management, customer follow-up, etc.).
• The principle of data minimisation. The company must only collect data that is strictly essential for its proper functioning.
• A defined retention period. Information is retained for a fixed period. The data must then be deleted, archived or anonymised.
• Security. The company must implement all necessary measures to protect the information entrusted to it.
• Individual rights. Individuals must be able to easily access, rectify and delete (“right to be forgotten”) the information provided.

Data protection regulations are constantly evolving. It is therefore essential to keep a close eye on developments and adapt practices accordingly.

What are companies’ obligations regarding data privacy and data management ?

The company director is the data controller. As such, they are responsible for putting in place the necessary measures and protocols for the processing and protection of personal data.

Ensuring transparency and respect for individuals

Anyone whose personal data is collected must be informed of how this information is used and for what purpose. They must be provided with a full set of details on this matter, including the name of the data controller, whether the provision of this information is mandatory or not, how long the data will be retained, and the rights they have in relation to this data (access, rectification, objection, portability, erasure).

This information must be provided at the time of collection where this is direct, or within one month where it is indirect (as is the case with information obtained from public sources). It must be worded clearly and concisely so that the individual can give their consent freely, in an informed, specific and unambiguous manner. Such consent may be mandatory prior to any processing.

Do you have a website? This information must appear on your privacy policy page (which is part of the mandatory legal notices). A cookie management banner may also be implemented, but it is prohibited to pre-tick any boxes.

Without prior information, you risk a criminal fine.

These transparency requirements are not merely legal obligations: they help to foster a climate of trust and enhance your company’s credibility.

Establishing data governance

Data governance refers to the set of protocols implemented within an organisation to ensure the confidentiality, security, accuracy, availability and usability of information. It encompasses standards, technical processes and organisational systems.

To comply with the principle of accountability and ensure your company’s compliance with data protection rules, two actions are essential :

• Maintain a data register. This records all data processing activities to provide a clear overview of the actions carried out. Keeping such a register is mandatory for organisations with more than 250 employees, but also applies to those below this threshold if you process sensitive data, data relating to criminal convictions, or data that poses a real risk to individuals’ rights and freedoms. This is the case, for example, for financial or healthcare companies.
• Appoint a Data Protection Officer (DPO). A Data Protection Officer is mandatory if your company processes a large volume of data or if the nature of your business involves large-scale monitoring of individuals.

Data governance is essential for structuring the internal management of your data and driving your growth.

Improving security and anticipating risks

The security measures to be put in place must be proportionate to the nature of the data being processed and the specific risks associated with your business.

Regulating data processing

Start by establishing a framework for data processing :

• Identify the data processing activities and the media used ;
• Map out the interconnection and data flow diagrams from collection to deletion ;
• Draw up an action plan dedicated to your company’s IT security ;
• Schedule regular checks to identify any new risks.

Develop a logging system

A logging system records all technical and business-related user activities, as well as any anomalies or security-related events. It is an essential tool for detecting incidents and responding to data breaches.

Taking action on multiple levels

To enhance security, there are several measures that can be taken, including :

• Restricting user authentication and authorisation. Assign a unique username to each individual and limit access according to their authorisation level.
• Protecting IT equipment and the network. Installing firewalls, setting up automatic session lock-out systems, regularly updating antivirus software, segmenting the network, and deleting data from a workstation before it is reallocated are examples of common measures. Your teams must also be made aware of the risks associated with the use of mobile devices (theft, connecting to unsecured public networks).
• Securing servers. This can be achieved using the TLS protocol for data encryption, as well as malware detection software.
• Perform regular data backups (including one offline). Remember to protect these backups to the same standard as your production systems.

Assess the risks

The level of risk must be assessed on a regular basis, in line with the level of risk associated with your business. In the event of an incident, your company must be able to demonstrate that it has taken appropriate measures.

Where data processing poses a significant risk to the rights and freedoms of individuals, a data protection impact assessment (DPIA) must be carried out. This involves assessing the risks, the proportionality of the actions taken and the measures envisaged to manage them.

Create management protocols

Any security incident must be handled in accordance with a formal procedure. The document must set out the criteria for classifying the incident and the people to contact in the event of a problem. Please note that in the event of a breach that is likely to infringe on individuals’ rights and freedoms, you have 72 hours to notify the CNIL.

Monitoring data flows to third parties

If you use third-party organisations to manage your data, you should check that they offer sufficient safeguards. Request the organisation’s security policy and verify their expertise and resources. You should then draw up a data processing agreement to formalise the purpose of the processing, set out the division of tasks and responsibilities, and specify the procedures for processing the information.

If you use an organisation based outside the EU, check that its country of residence is covered by an adequacy decision from the European Commission (the list is available on the CNIL website). If no decision has been issued, you should require guarantees from the organisation: adherence to a code of conduct, the signing of a contract incorporating the European Commission’s standard contractual clauses, or the implementation of binding corporate rules.

What are the issues and challenges involved in implementing this for companies ?

The risks of non-compliance

The implementation of a privacy and data processing policy is mandatory and governed by law. In the event of non-compliance, the company faces significant financial penalties, or even criminal sanctions.

Beyond the legal aspect, any data breach also has an impact on the company’s reputation. Conversely, a strict policy serves as a means of strengthening consumer confidence.

Technological development

The digitisation of tools and storage systems (the cloud, connected devices), as well as the development of artificial intelligence and big data, are heightening the challenges associated with data management.

These developments make information processing more complex and increase the risk of potential security breaches. It is therefore essential to establish a governance policy that is adapted to current challenges.

Respecting confidentiality in data management is a major challenge in the digital transformation of businesses. Within the framework of the GDPR, the aim is to ensure the useful and consistent processing of information to accelerate the growth of organisations whilst guaranteeing data protection. Whilst these obligations represent an organisational and technical constraint, they also constitute an essential lever for building trust. Reveals supports you in establishing a governance policy tailored to your business challenges. Contact us to identify the key areas for structuring your data flow processing to accelerate your growth.  

Q&A

What is personal data ?

Personal data is information that directly or indirectly identifies an individual. Examples include a surname, first name, home address, IP address, telephone number or fingerprint.

What is the difference between the GDPR and the CNIL?

The GDPR is the European regulation governing the protection of personal data. The CNIL is the French authority responsible for its enforcement within France. It supports organisations in achieving compliance.

What are the stages involved in data processing ?

Data is first collected and then recorded. It can then be used, modified or even shared if necessary. It is retained for a specified period before being deleted or anonymised.

L’article Data privacy and management : how can we ensure data security ? est apparu en premier sur REVEALS.

Key points :

• A GDPR register lists all data processing activities ;
• It is mandatory for many organisations that handle personal data ;
• Its contents must be updated as soon as any processing activities change ;
• It is a management tool designed to secure your data and improve your internal processes.

Are you looking to set up a GDPR register within your organisation? This document enables you to centralise all your personal data processing activities so that you can manage your strategy and remain compliant with your data protection obligations. Reveals explains how to create and maintain a record of processing activities.

What is a data processing register ?

Governed by Article 30 of the General Data Protection Regulation, the record of processing activities (also known as the GDPR record) is an internal document that centralises all the procedures through which your organisation collects, uses and manages personal data. It provides you with a comprehensive overview of your processing activities, enabling you to identify practices that need to be improved and to verify that each procedure put in place is genuinely useful and relevant to your organisation.

It is a key document for ensuring compliance with the principle of accountability. It lists all the measures implemented by your company to comply with the obligations of the GDPR. It is one of the first documents requested during inspections by the CNIL (French Data Protection Authority). It enables you to demonstrate that you comply with European regulations on the protection of personal data.

Note that there are two types of register :

• A register for data controllers;
• A register for data processors

If your company is both a data controller and a data processor, you will need to maintain two separate registers. This situation is particularly common among HR firms and IT service providers.

Good to know : you can find a downloadable example of a simplified GDPR processing register on the CNIL website.

Who is required to keep a GDPR record?

In principle, all organisations that collect personal data (from their employees, customers, suppliers, etc.) are required to maintain this record of processing activities. However, the regulations provide for exemptions for organisations with fewer than 250 employees.

Such organisations are actually required to maintain this register when they process data of a sensitive nature (health, biometrics, etc.) that may pose a risk to personal freedom. If you are unsure about the nature of the data you manage internally, the CNIL recommends that you include this information in your register. In fact, if you work in a financial institution, it is still necessary to create and regularly update this document even if you are a small independent organisation (such as a brokerage firm).

What is the value of this document for businesses ?

Comply with GDPR regulations

Since 2018, all organisations collecting data from European residents have been required to comply with the General Data Protection Regulation. When you collect and process personal information (such as your customers’ names and contact details), you must put in place all necessary measures to protect it.

The processing activity register formalises this approach. By documenting exactly why and how each type of information you use is processed, you have a solid basis for demonstrating your compliance.

Identify the data most at risk

Sensitive data requires the implementation of advanced security measures. This will enable you to tailor your approach according to the level of sensitivity.

It is important to ensure that only authorised personnel have access to it. You can also implement advanced security measures, such as encrypting your data or strengthening the security of your servers and IT network.

Check that your data is actually useful to your business

Your organisation is required to comply with the principle of data minimisation. This means that you must only process information that is relevant to the fulfilment of a legitimate, explicit and specific purpose. If certain data is not justified, you must delete it.

Reveals supports you in strengthening your data governance. We help you structure areas of responsibility and implement appropriate management systems. Discover our data governance advisory services to structure and manage your data.

How do you create a record of processing activities ?

You are free to create a record either in electronic or paper format. However, it must include certain essential information.

The data controller’s record

Your record lists all processing activities in the form of individual entries.

Each entry must include the following details:

• The name of the processing activity;
• The name and contact details of the data controller responsible for the processing activity, as well as those of the company’s Data Protection Officer (DPO), where applicable;
• The purposes of the processing activity (specifying the primary purpose and any secondary purposes);
• The categories of personal data involved in the processing activity;
• The categories of data subjects (who the information relates to);
• The recipients of the data (including processors);
• The list of security measures implemented to protect the data;
• Any data transfers carried out;
• The planned retention periods.

The processor’s record

If you also process your clients’ data, you must maintain a record of categories of processing activities.

Each entry must contain the following information:

• The name and contact details of your organisation;
• The name and contact details of your client, their data controller and, where applicable, their representative;
• The name and contact details of your processors (where applicable);
• The categories of processing activities concerned;
• The security measures implemented;
• Any transfers of data to a third country or international organisation, along with the associated safeguards.

You may supplement this record with any information you consider useful.

How should you maintain and update your GDPR record ?

This record is maintained by the data controller, a processor or the Data Protection Officer (DPO), if the organisation has one.

When creating it, all activities involving the use of personal data should be identified. Within a company, this may include recruitment, HR management, payroll management, customer portfolio management or employee training.

To begin your initial assessment, contact all departments and individuals within your organisation who use personal data. You should also review your website to identify all information collected through online forms.

Next, list all activities involving personal data. You can then complete one entry per activity and gain a clear overview of all processing operations carried out within your organisation.

Finally, assess the risks related to data security in order to implement the necessary actions to remain compliant with the GDPR.

And remember to update this record whenever a process changes. Any modification must be recorded to ensure the accuracy of the document.

Who should this personal data record be shared with ?

This is an internal company record. However, it may be requested by the CNIL as part of a GDPR compliance inspection. During such an inspection, the authority verifies that the procedures in place guarantee the security of personal data during processing.

Implementing a GDPR record is an essential step for any organisation that processes personal data. Beyond regulatory compliance, this document provides a clear overview of your practices, helps identify areas for improvement and strengthens the security of your processing activities. Reveals supports businesses in implementing governance policies tailored to their needs in order to secure and fully leverage their data. Contact us to deploy a control and monitoring framework adapted to your organisation.

Q&A

What GDPR records are mandatory ?

There are two types of data processing records: the record maintained by the organisation collecting the information and the record maintained by processors. Where an organisation performs both roles, it must maintain two separate records.

How often should the record of processing activities be updated ?

It must be updated whenever a data processing procedure changes.

What are the penalties for failing to maintain a processing record ?

If an organisation processing personal data fails to maintain a GDPR record in accordance with European regulations, it may face a fine of up to €10 million or up to 2% of the company’s annual worldwide turnover.

L’article GDPR records : why and how should they be kept ? est apparu en premier sur REVEALS.