If your company wants to avoid fines, it should be 100% compliant with the above principles. GDPR explicitly states that infringements of the basic principles for processing personal data are subject to the highest tier of administrative fines. This could mean a fine of up to \u20ac20 million, or 4% of your total worldwide annual turnover, whichever is higher.<\/p>\n\n\n\n
Lawful Basis<\/h2>\n\n\n\n
The lawful basis for data processing is:<\/p>\n\n\n
- \n
- Consent<\/li>\n\n\n\n
- Contract<\/li>\n\n\n\n
- Legal obligation<\/li>\n\n\n\n
- Vital interests<\/li>\n\n\n\n
- Public task<\/li>\n\n\n\n
- Legitimate interest<\/li>\n<\/ul>\n\n\n
In the specific case of IT service providers, the main basis for data processing is the contract signed with the client (a data controller) with all the conditions of cooperation regarding processed information.<\/p>\n\n\n\n
Individual Rights<\/h2>\n\n\n\n
Individual rights which are guaranteed by GDPR:<\/p>\n\n\n
- \n
- Right to be informed<\/li>\n\n\n\n
- Right of access<\/li>\n\n\n\n
- Right to rectification<\/li>\n\n\n\n
- Right to erasure<\/li>\n\n\n\n
- Right to restrict processing<\/li>\n\n\n\n
- Right to data portability<\/li>\n\n\n\n
- Right to object<\/li>\n\n\n\n
- Right related to automated decision-making including profiling<\/li>\n<\/ul>\n\n\n
These rights are mostly connected with the data controller but also indirectly with the data processor, as well. The data processor is obliged to act in accordance with the rules and demands imposed by the data controller.<\/p>\n\n\n\n
Data Controller vs. Data Processor<\/h2>\n\n\n\n
Understanding whether you are processing personal data is critical in order to understand whether GDPR applies to your activities.<\/p>\n\n\n\n
Data controllers\u2019 obligations are much wider than data processors' and that is the reason for such acting, as well as the fact that service providers cannot control and determine the way in which information will be used.<\/p>\n\n\n\n
If you exercise overall control of the purpose and means of the processing of personal data \u2013 i.e. you decide what data to process and why \u2013 you are a controller. Controllers are the main decision-makers \u2013 they exercise overall control over the purposes and means of the processing of personal data. Controllers make decisions about processing activities and are ultimately in charge of and responsible for the processing.<\/p>\n\n\n\n
If you don\u2019t have any purpose of your own for processing the data and you only act on the client\u2019s instructions, you are likely to be a processor \u2013 even if you make some technical decisions about how you process the data.<\/p>\n\n\n\n
A controller can be a company or other legal entity (such as an incorporated partnership, incorporated association or public authority), or an individual (such as a sole trader, partner in an unincorporated partnership, or a self-employed professional, a lawyer, etc.)<\/p>\n\n\n\n
Although the processor may make its own day-to-day operational decisions, GDPR says it should only process personal data in line with the controller\u2019s instructions, unless it is required to do otherwise by law. In any case, the processor should implement appropriate technical and organizational measures to account for security risks and to assist the controller in responding to requests of individuals.<\/p>\n\n\n\n
Processors must, in any case, keep personal data confidential and obligate their personnel to the same confidentiality obligations.<\/p>\n\n\n\n
Processors should keep necessary records and make them available to controllers and regulators if needed. Processors should notify controllers of a data breach incident ASAP and provide support in those cases, and process personal data only to the extent authorized by the controller.<\/p>\n\n\n\n
Processors should obtain controllers\u2019 written permission before engaging subcontractors which act as s sub-processors. Entering into contracts with sub-processors should provide the same level of protection as the principal contract with controller. Also, processors must delete or return to the controller (at the controllers\u2019 choice) all personal data when no longer providing services. In any case, processors should train employees on GDPR and create company policies in compliance with GDPR.<\/p>\n\n\n\n
![\"\"](\"https:\/\/cdn.shortpixel.ai\/spai\/q_glossy+ret_img+to_auto\/serengetitech.com\/wp-content\/uploads\/2020\/12\/Keep-Calm-message-1024x606.png\")