As of May 25 , 2018, the General Data Protection Regulation (AVG or its English abbreviation GDPR) is in effect. It replaces the current Personal Data Protection Act.
Step by step how it works
Companies and organizations that process personal data will have more obligations. They must be able to demonstrate compliance with the law.
To fully read up around the topic , we recommend the following:
- Read the article on AVG / GDPR at Melis GS.
- Among other things, read the information about the new legislation on the Authority for Personal Data website.
- Delve further into GDPR legislation
Checklist AVG/GDPR
1. SSL on your website
All sites should only be able to be visited via https (sites are then also significantly faster because HTTP/2 is used ).
Technically , an SSL connection is only applicable for pages where privacy-sensitive information is processed, such as a contact page . For practical and search engine reasons, we absolutely recommend fully SSL-enabling your website. If you need help with this you can contact us.
2. Privacy page
It is important as a company to have a page on your site where you show what data you process and for what purpose.
3. Connect email securely
Make sure email is only retrieved and sent securely. Connecting your email via SSL is a must these days, since with non-SSL connections, all data on the same local network is fully readable by others. When you use our recommended email settings, you comply with this. For example, all our hostnames come with SSL certificates that we manage securely and professionally.
4. Processor Agreement
Make sure you have signed processor agreements with Melis GS and other applicable data processors.
5. Other matters
What else should you consider?
- There are hefty fines for violations of this law. If the Personal Data Authority determines that a company or organization is not complying with the road, fines can be imposed up to 4% of annual turnover or up to 20 million Euros.
- The rights of data subjects become much stronger. They should be able to easily access the data held about them, correct it and also have the right to delete it. People should also be able to easily obtain and transfer data to whomever they want.
- Keeping a register of processing activities is mandatory. Document what personal data is being processed and for what purpose, where this data comes from and with whom it is shared.
- Your clients may be required to conduct a Data Protection Impact Assessment. This is particularly the case if the registration contains sensitive items such as bank data, sexual orientation, religion, health data, for example. Leaks of these data could have major consequences for those involved.
- Privacy by design Privacy by default. Privacy by design means already taking into account the protection of the personal data entered when creating a Web site. Privacy by default means not requesting/registering more data than strictly necessary, for example:
- an app that you offer not to have users’ location recorded if it is not needed;
- On the website, do not pre-tick the “Yes, I want to receive offers ” box;
- if someone wants to subscribe to the newsletter, not to ask for more data than necessary.
- Data Protection Officer. Companies and organizations may be required to appoint such an officer. Of course, they may also do so voluntarily.
- Consent. Note that you must be able to demonstrate that people give permission for their data to be stored and processed. People should also be able to withdraw their consent just as easily.
0 Comments