General Data Protection Regulation: Difference between revisions

Revision as of 15:51, 30 October 2024

Revision as of 20:04, 31 October 2024

Line 140:

====Security of personal data====

Controllers and processors of personal data must put in place ''appropriate technical and organizational measures'' to implement the data protection principles.<ref>{{Cite web |title=Secure personal data {{!}} European Data Protection Board |url=https://www.edpb.europa.eu/sme-data-protection-guide/secure-personal-data_en |access-date=2024-05-16 |website=www.edpb.europa.eu}}</ref> Business processes that handle personal data must be designed and built with consideration of the principles and provide safeguards to protect data (for example, using [[pseudonymization]] or full [[Data anonymization|anonymization]] where appropriate).<ref>{{Cite web |date=2023-07-01 |title=Data protection by design and default |url=https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/accountability-and-governance/data-protection-by-design-and-default/ |access-date=2024-05-16 |website=ico.org.uk |language=en}}</ref> Data controllers must design information systems with privacy in mind. For instance, using the highest-possible privacy settings by default, so that the datasets are not publicly available by default and cannot be used to identify a subject.<ref>{{Cite web |date=2023-09-04 |title=How to protect your privacy online |url=https://onerep.com/blog/how-to-protect-your-privacy-online |access-date=2024-05-16 |website=onerep}}</ref> No personal data may be processed unless this processing is done under one of the six lawful bases specified by the regulation ([[consent]], contract, public task, vital interest, legitimate interest or legal requirement). When the processing is based on consent the data subject has the right to revoke it at any time.<ref>{{Cite web |title=What if somebody withdraws their consent? - European Commission |url=https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations/legal-grounds-processing-data/grounds-processing/what-if-somebody-withdraws-their-consent_en |access-date=2024-05-16 |website=commission.europa.eu |language=en}}</ref>

'''Article 33''' states the data controller is under a legal obligation to notify the supervisory authority without undue delay unless the breach is unlikely to result in a risk to the rights and freedoms of the individuals. There is a maximum of 72 hours after becoming aware of the data breach to make the report. Individuals have to be notified if a high risk of an adverse impact is determined.<ref name="32016R0679"/>{{rp|Art. 34}} In addition, the data processor will have to notify the controller without undue delay after becoming aware of a personal data breach.<ref name="32016R0679"/>{{rp|Art. 33}} However, the notice to data subjects is not required if the data controller has implemented appropriate technical and organisational protection measures that render the personal data unintelligible to any person who is not authorised to access it, such as encryption.<ref name="32016R0679"/>{{rp|Art. 34}}