A Summary of the Key GDPR Requirements

What are the key requirements of GDPR?

1.Legitimate basis for data: An organisation must know and be able to prove that, for any processing it performs upon personal data, there is a legitimate purpose for doing so.

2. Information you hold: An organisation should keep data only insofar as necessary.

3. Individuals rights: Individuals have the right to:

• Ask what information one has about them and what one does with it
• To ask for correction
• To object to processing
• To lodge complaint
• To withdraw consent
• To request deletion of their personal data

4. Consent: The individual should have express and direct consent to the processing of personal data.

5. Children's data: For processing of children’s data, GDPR requires the explicit consent of the child’s parents (or guardian) for minors less than 16 years of age.

6. Privacy notices: Organisations must make their approach to the security of personal data transparently known in a privacy notice that is readily available to data subjects. This privacy notice should have a simple, easily understood language.

7. Data breaches: Organisations must maintain a data breach register and, based on risk the regulator and data subject should be informed within 72 hours of identifying the breach.

8. Privacy by design: Mechanisms for the security of personal data should be incorporated in the design of new systems and processes so that privacy and protection aspects are guaranteed by default.

9. Data Privacy impact assessment: When introducing new initiatives like a project, campaign, or product that would process personal data, the company must perform a data privacy impact assessment to review the impact and potential risks.

10. Data Protection Officers: The company should, in certain circumstances, designate a data protection officer whose name is published on the website of the company and known by the regulator so that he/she can be contacted by data subjects or regulators where appropriate.

11. Third parties: The controller of personal data has the responsibility to ensure that personal data is protected and GDPR requirements are respected, even if processing is performed by a third party.

12. Awareness: To make the staff aware of key data security standards, perform daily training to ensure that personal data of data subjects are secured and that violations are detected as soon as possible.