French law · What you cannot prove
GDPR: achieving compliance and being able to demonstrate it
Nobody will ask you whether you are compliant. You will be asked to prove it.
Objectives
- Identify the data processing activities actually carried out in the business
- Keep a usable record of processing activities, rather than a document produced once and then forgotten
- Put contracts in place with your processors and respond to requests from your own clients
- Know what to do in the first hours of a personal data breach
Programme
- Morning: What you hold without thinking about it: The inventory: clients, prospects, employees, applicants, video surveillance, access badges, geolocation · For each processing activity: its purpose, its legal basis, how long data is kept, who has access · Retention periods: the question on which most files fall down · The record of processing activities, completed during the session for your own processing
- Afternoon: Demonstrating, and keeping it up: The accountability principle: being compliant is not enough, you must be able to show it · Your processors and your clients: the contracts that govern processing, and what you will be asked to sign · Data subjects' rights: what an employee, an applicant or a client can demand, and within what time limit · Personal data breaches: the first hours, who to notify, what to write
Prerequisites
None.
What you take away
Your record of processing activities started and your procedure in the event of a data breach.