Ready for GDPR?

Recently passed the Certified Data Protection Practitioner CDPP Exam by Irish Computer Society ICS. I highly recommend this course for DPOs. After the three (3) day course, certification exam takes place third Fridays of the month but ICS can arrange for you to take the exam later if you wish.

Many people have talked about what is required before May 25, 2018; however, very little is said about days, weeks, months and years after. GDPR does not end on May 25. Hence, some people's preparation for GDPR is partial..."something to see them through the door"... Really?

The Data Protection Commissioner will Educate, Encourage but also Enforce. Please pay attention to the last word "Enforce" and do your due deligence. Pay attention to the needful.

Some vital points to consider; Understand Consent, Legal Basis of Processing, Consider applicable requirements before relying on consent to justify processing of children's data carefully, Prepare your Data Subject Access Request Response, Right to erasure aka "Right to be forgotten". If you own a website, review your cookie compliance with respect to consent. Update your website Privacy notification to GDPR standard. Big organizations should pay attention to PIA, DPIA and PbD, International Transfers.

Take away: GDPR apply to the processing of personal data by controllers and processors in the EU, regardless of whether the processing takes place in the EU or not. It will also apply to the processing of personal data of subjects in the EU by a controller or processor not established in the EU, where the activities relate to: offering goods or services to EU citizens (irrespective of whether payment is required) and the monitoring of behaviour that takes place within the EU. Finally, Non-EU businesses processing the data of EU citizens will also have to appoint a representative in the EU.DPR applies to business.

These words are my idea; it does not represent views or opinions of the organization I work with.