DSGVO tips: so that the vest remains white

So it's worth starting to restructure the data budget sooner rather than later. But where should companies start that don't yet have a Data Protection Officer (DPO) at hand? Here are a few tips on how you can jump right into the topic.

1. A data map helps with the first orientation

Before the era of the smartphone, what was the first thing we did when we traveled to a new city? Quite clearly: get a map of the city for initial orientation. That's exactly what you should do to prepare for your data restructuring. Round up all engineers, product managers and analysts and identify together where data is collected or processed everywhere in the company and for what purpose. This document initially serves as an inventory and as a roadmap for all further steps.

2. Hunter or gatherer?

In general, within the framework of the GDPR, a distinction is made between Data Processor and Data Controller differentiated. During the Data Controller is legally responsible for the collection and generation and determines how the data may be further used, the Data Processor only responsible for processing along those same lines. Since different requirements apply to both instances, companies should understand exactly which group they belong to. You can also call in a consultant at any time to help you with this.

3. Classify interests and substantiate a legal basis for processing

The GDPR allows some legitimate starting points for the processing of personal data. The two most common are "legitimate interest" and "consent". The former applies when the company can demonstrate a legitimate interest in using the data (e.g., when the business model relies on it). In the second case, processing is legitimized by the dedicated consent of each user. Here, you should use the data map to determine which regulations you want to take advantage of and record in great detail why this is justified in your particular case.

4. Who writes, who stays

From this point on, you should ensure that all operations in the company that deal with the processing of personal data are logged. And you should do so in such a complete and well thought-out manner that you will pass a surprise inspection by an official auditor with flying colors. To do this, it is essential that the auditor can see that you have taken the new basic regulation into account in the structure of your services and products and have realigned them (privacy by design) and that all employees who work directly with data have received sufficient training.

5. Eyes open when choosing a partner

Since its introduction on May 25, 2018, you can be held accountable for all of your partners' data processing practices just as much as the partner itself. In plain language, this means that you should check very carefully whether the company is suitable for cooperation and acts in compliance with the guidelines. To do this, you can use the following questions as a guide, for example:

1. Who in the company is responsible for GDPR compliance?
2. On what documented legal basis is the data processing based? (Consent/ legitimate interest?)
3. Has the company hired a data protection officer?
4. Is the company a "controller" or a "processor" of data?
5. How are access requests from users to their data handled?
6. How are the systems secured?
7. Has the company itself identified the areas where data is processed and optimized them according to the guidelines?
8. What is the company's position on e-privacy and what is planned in this regard if the business model is directly affected?
9. Do they offer consent via opt-in?
10. What is the back-up plan?