1. The General Data Protection Regulation – in short
Overview
Applicable as of 25 May 2018
Protects data on natural persons (customers, employees, contact persons etc.)
Protects all types of personal data (name, address, , phone number, CV, salary, purchase history, arrears etc.)
Re-enacts almost all the current rules in the Danish Data Protection Act and introduces new requirements at the same time
Game changer: Penalty by fine significantly increased (up to EURm or 2-4% of the annual global revenue)
A good reason – and occasion – to thoroughly review how you handle personal data
Focus areas
Legal basis for processing, e.g. consent, contract with the data subject or balancing of interests
Deletion rules
Obligation to provide information to data subjects
Data subjects’ rights, e.g. the right to access personal data
Third parties and data processing agreements
IT security (who can access data etc.)
Adaptation of IT systems to handle and support new requirements
Establishment of process documentation