Data subjects must know that you are collecting their data, why you are processing it and who you are sharing it with.

You should publish a privacy policy on your website and include it in any form or communication you send to individuals. The notice must be:

• concise, transparent, intelligible and easily accessible
• written in clear and plain language, particularly if addressed to a child
• free of charge

The content of the notice depends on whether the personal data was obtained directly from the data subject or from a third party.

You must provide children with the same privacy information you provide to adults. It is good practice to also explain the risks associated with the processing and the safeguards you have put in place.

Any information directed to a child should be concise, clear, and written in plain language so that they are able to understand what will happen to their personal data and what their rights are. The notice should be age-appropriate and presented in a way that appeals to a young audience.

If children under the age of your target audience are likely to try and access the online services you provide, try to explain the age limit to them in language they can understand.

Data subjects have the right to obtain:

• confirmation that you are processing their data
• access to their personal data
• other supplementary information: this largely corresponds to the information you must provide in a privacy notice

Data subjects can request access to their data verbally or in writing. You are obliged to provide a copy of the information free of charge but can charge a "reasonable fee" when a request is:

• manifestly unfounded or excessive, particularly if it is repetitive, unless you refuse to respond
• for further copies of the same information that has been previously provided. This does not mean that you can charge for all subsequent access requests

You must base the fee charged on the administrative cost of retrieving and providing the information.

You must provide the information without delay and in any event within one month of receipt. You can extend this period by a further two months for complex or numerous requests, in which case you must inform the individual and provide a valid justification. The time limit starts from the day following receipt of the request, regardless of whether the next day is a working day, until the corresponding calendar date in the following month.

You must verify the identity of the person making the request using reasonable means. If the request is made electronically, you must provide the information in a commonly used electronic format.

Data subjects have the right to have data rectified if it is incorrect and completed if it is incomplete.

Data subjects can make requests for rectification or completion of data verbally or in writing.

You must comply with requests without delay and in any event within one month of receipt. You can extend this period by a further two months for complex or numerous requests, in which case you must inform the individual and provide a valid justification. It is good practice to keep track of requests so you have an up-to-date picture of the situation.

You must verify the identity of the person making the request using reasonable means. If you share data with others, you must inform them of the rectifications made.

You need to periodically review the processed data to identify when updates or rectifications need to be performed. Records management policies, with rules for their creation and for the retention of the data contained (e.g. for email address lists), can be a valid help.

Conducting regular reviews of data accuracy in digital systems and paper records you hold will help ensure that the information continues to be adequate for the purposes for which you are processing it.

You should ensure you perform regular data quality checks to have assurances on the accuracy of the data entered by your staff into the processing systems. If you detect data accuracy issues entered into your systems, you must communicate what happened to staff through awareness campaigns and by initiating ongoing training actions.

Data subjects have the right to be forgotten (right to erasure) and can request the deletion of their personal data when:

• the data is no longer necessary for the purpose for which it was originally collected and processed
• the data subject withdraws consent for its processing
• if you are basing the processing on a legitimate interest of yours, the data subject objects to the processing of their data and there is no overriding legitimate interest to continue processing it
• if you are processing personal data for direct marketing purposes, the data subject objects to such processing
• they have been unlawfully processed (i.e. in breach of the GDPR)
• they must be erased to comply with a legal obligation
• they are processed for information society services directed to minors

Data subjects can request data deletion verbally or in writing. You must also verify the identity of the person making the request using reasonable means.

You must comply with requests without delay and in any event within one month of receipt. You can extend this period by a further two months for complex or numerous requests, in which case you must inform the individual and provide a valid justification.

You can refuse to comply with a deletion request if you are processing personal data for the following reasons:

• to exercise the right of freedom of expression and information
• to comply with a legal obligation
• to perform a task carried out in the public interest or in the exercise of official authority vested in you
• for archiving purposes in the public interest, scientific, historical research or statistical purposes
• to exercise the right to establish, exercise or defend legal claims
• for public health purposes in the public interest
• for the purposes of preventive or occupational medicine, if the processing is carried out by or under the supervision of a health professional

A written retention policy or schedule will remind you when to dispose of different categories of data and help you plan their secure destruction.

You should regularly review your retention schedule to ensure you are always meeting business and legal requirements, agree any changes with relevant professionals and incorporate them into the new schedule.

You should assign responsibility for data retention and proper destruction to a person appropriate to the role.

Data subjects have the right to block or restrict the processing of their personal data.

Data subjects can request a restriction on processing verbally or in writing. You must also verify the identity of the person making the request using reasonable means.

You must comply with requests without delay and in any event within one month of receipt. You can extend this period by a further two months for complex or numerous requests, in which case you must inform the individual and provide a valid justification.

When processing is restricted, you are only allowed to store the personal data, to the exclusion of any other processing. You may only retain sufficient information to assure the data subject that the restriction is respected in the future. As a matter of good practice you should consider restricting the processing of personal data if:

• the data subject contests the accuracy of the personal data you are processing, in which case you should restrict processing until you have verified its accuracy
• the data subject has objected to the processing, where it was necessary for the performance of a task carried out in the public interest or for a legitimate interest of yours, and you are considering whether those interests override those of the data subject
• the processing is unlawful, the data subject opposes the erasure of the data and requests restrictions on its processing instead
• you no longer need the personal data, but the data subject requires the data to be kept in order to establish, exercise or defend a legal claim

You should review your procedures to ensure you are able to determine if and when personal data processing needs to be restricted.

If you share personal data with others you will need to inform them of the restrictions on its processing, unless this is impossible or involves disproportionate effort.

You must inform data subjects when you decide to lift a restriction on processing.

The right to data portability allows data subjects to obtain and reuse their personal data for their own purposes across different services.

Data subjects can safely and seamlessly receive, move, copy, or transfer their personal data from one company to another.

The right to data portability only applies:

• to personal data provided by an individual to a controller
• if the processing is based on the data subject's consent or for the performance of a contract
• if the processing is carried out by automated means

Data subjects can make portability requests verbally or in writing. You must also verify the identity of the person making the request using reasonable means.

You must comply with requests without delay and in any event within one month of receipt. You can extend this period by a further two months for complex or numerous requests, in which case you must inform the individual and provide a valid justification.

You must provide the personal data in a structured, commonly used and machine-readable format. Examples of appropriate formats include CSV and XML files.

You must provide the information free of charge. If the data subject requests it, you may be required to transmit the data directly to another company where technically feasible.

Data subjects have the right to object to the processing of their personal data in certain circumstances. The application of this right depends on the purposes of the processing and the lawful basis on which it is based. You must inform data subjects of their right to object "at the time of first communication" and present it clearly and separately from any other information about their rights in your privacy notice.

Data subjects can object to processing verbally or in writing, and you must verify the identity of the person making the request using reasonable means.

You must comply with requests without delay and in any event within one month of receipt. You can extend this period by a further two months for complex or numerous requests, in which case you must inform the individual and provide a valid justification.

If the right to object applies, it is not always absolute. Whether it is an absolute right depends on your purposes for processing.

Data subjects have an absolute right to object to any processing, including profiling, undertaken for direct marketing purposes.

You must stop processing for direct marketing as soon as you receive an objection. There are no exemptions or grounds to refuse in this case.

Data subjects can object, on "grounds relating to their particular situation", to processing, including profiling, based on:

• your legitimate interests
• the performance of a task in the public interest
• the exercise of official authority

In the circumstances of the previous point, the right to object is not absolute. You must in fact stop processing unless:

• you can demonstrate compelling legitimate grounds for the processing, which override the interests, rights, and freedoms of the individual
• the processing is for the establishment, exercise, or defence of legal claims

If you process personal data for scientific, historical research, or statistical purposes, the right to object is more limited and does not apply if the processing is necessary for the performance of a task carried out for reasons of public interest.

The GDPR provides safeguards for individuals against the risk that a potentially damaging decision is made without human intervention, more specifically these are set out in Article 22.

Data subjects have the right not to be subject to a decision when:

• it is based solely on automated processing, including profiling
• it produces a legal effect or a similarly significant effect on the data subject

You can only carry out this type of processing if the decision is:

• necessary for entering into or performing a contract between a data controller and the data subject
• authorized by law (e.g. for the purposes of fraud or tax evasion prevention)
• based on the data subject's explicit consent

If one of the exceptions in the previous point applies, you must implement suitable measures to safeguard the individual's rights, freedoms, and legitimate interests. These measures must include at least the data subjects' right to:

• obtain human intervention
• express their point of view
• obtain an explanation of the decision and be able to challenge it

Data subjects can exercise these rights verbally or in writing, and you must also verify their identity using reasonable means.

You must comply with requests without delay and in any event within one month of receipt. You can extend this period by a further two months for complex or numerous requests, in which case you must inform the individual and provide a valid justification.

The GDPR defines profiling as any form of automated processing intended to evaluate certain personal aspects of an individual, in particular to analyse or predict:

• performance at work
• economic situation
• health
• personal preferences
• reliability
• behaviour
• location
• movements

If the decision involves the processing of special categories of personal data, the exceptions available to justify automated processing are more limited. Processing can only take place if:

• you have the explicit consent of the data subject
• processing is necessary for reasons of substantial public interest

Particular care must be taken if the automated decision involves a child.

The GDPR requires you to document how you comply with legal principles.

A codified policy will help you manage data protection consistently and demonstrate accountability under the GDPR. This can be implemented by drafting a standalone policy or as part of a general personnel management policy.

The guidelines should clearly set out your approach to data protection along with responsibilities for overall policy implementation and compliance monitoring.

Management should approve the guidelines, publish them, and communicate them to all staff. You must review and keep them updated at planned intervals or when necessary to ensure they remain fit for purpose.

Documenting policies is often not enough to ensure staff are adhering to the processes they describe.

You must ensure you have procedures in place to monitor compliance with data protection and security policies.

You should regularly test the measures detailed within policies to provide assurances of their continued effectiveness.

The responsibility for monitoring policy compliance should be independent from the people implementing the guidelines, to allow the monitoring to be impartial. Staff should regularly report the results of compliance testing to management.

You must inform all staff handling personal data about their data protection responsibilities. It is good practice to deliver awareness training at or immediately after appointment and at regular intervals or when required.

You should also consider specialist training for staff with specific duties, such as information security, records management, and marketing.

Regularly communicating relevant information is equally important to reinforce training and maintain awareness, e.g. via intranet, circulars, meetings and posters.

Whenever you use a data processor you must have a written contract or other legally valid act in place.

The contract is important so that both parties understand their legal responsibilities and obligations.

The GDPR sets out what must be included in the contract.

You are legally responsible for overall GDPR compliance and demonstrating that compliance. If you fall short, you could be liable to pay damages in legal proceedings or be subject to fines or other penalties or corrective measures.

You must only appoint data processors who can provide "sufficient guarantees" to meet GDPR requirements and protect the rights of data subjects.

Data processors must only act on documented instructions. However, they have some direct obligations and responsibilities under the GDPR. Failure to comply could leave them liable to pay damages in legal proceedings or be subject to fines or other penalties or corrective measures.

You could use a data processor's adherence to an approved code of conduct or certification scheme to demonstrate that you have chosen a qualified data processor. However, these are not yet available for all sectors.

Standard contractual clauses could be provided by the European Commission or the Data Protection Authority and form part of a code or certification scheme. However, these are not yet available for all sectors.

You should establish how you, and all your data processors, manage risk in information systems.

You need an expert profile to act as the manager of information risk management, coordinating the procedures put in place to mitigate them, system access policies, and IT asset risk assessments.

Where information risks have been identified, you must have appropriate action plans in place to mitigate any risks that have not been contained or resolved.

Under the GDPR, you have a general obligation to implement appropriate technical and organisational measures to show that you have considered and integrated data protection into your processing activities. This is referred to as data protection by design and by default.

You should adopt internal policies and implement measures that help comply with data protection principles, for example data minimization, pseudonymization, and transparency measures.

A DPIA helps you identify the most effective way to comply with your data protection obligations and meet data subjects' expectations about the protection of their personal data.

An effective DPIA will allow you to identify and resolve issues at an early stage, reducing damage to your reputation and the associated costs that could otherwise occur.

You must carry out a DPIA before starting any type of processing that is "likely to result in a high risk". This means that although you have not yet estimated the actual level of risk, you must investigate those factors that show a high potential for widespread or serious impact on individuals.

Specifically, the GDPR states that you must carry out a DPIA if you plan to:

• use systematic and extensive profiling with significant effects
• process special category data or criminal convictions and offences data on a large scale
• systematically monitor publicly accessible places on a large scale

The Data Protection Authority also requires a DPIA in the case of processing:

• involving large-scale evaluation or scoring, as well as processing involving profiling of data subjects and predictive activities
• automated, aimed at making decisions that produce legal effects or similarly significantly affect the data subject
• involving systematic use of data to observe, monitor, or control data subjects
• large-scale processing of data of an extremely personal nature, linked to family or private life, which affects the exercise of a fundamental right or the breach of which has a severe impact on the data subject's daily life
• carried out in the employment context through technological systems from which it is possible to carry out remote monitoring of employees' activities
• non-occasional processing of data relating to vulnerable subjects
• carried out through the use of innovative technologies, also with particular organisational measures
• involving the large-scale exchange of data between different controllers using telematic means
• personal data carried out by interconnecting, combining, or matching information, including processing that involves crossing digital goods consumption data with payment data
• special categories of data under Article 9 or data relating to criminal convictions and offences under Article 10 interconnected with other personal data collected for different purposes
• systematic processing of genetic data, taking into account, in particular, the volume of data, the duration, or persistence, of the processing activity

You should also consider carrying out a DPIA for any other large-scale processing that involves profiling or monitoring, deciding on access to services or opportunities, or involves sensitive data or vulnerable subjects. The Article 29 Data Protection Working Party guidelines on "Data Protection Impact Assessment (DPIA) and determining whether processing is "likely to result in a high risk" for the purposes of Regulation (EU) 2016/679" (WP248 document) provide a set of criteria to check against the envisaged processing to see if a DPIA should be carried out.

Even if there is no specific indication of a likely high risk, it is good practice to carry out a DPIA for any major new project involving the use of personal data.

The DPIA should contain the following information:

• a description of the nature, scope, context and purposes of the processing and, where applicable, the legitimate interests pursued by your business
• an assessment of the necessity and proportionality of the processing in relation to the purpose
• an objective assessment of the risks to data subjects, which takes into account both the likelihood and severity of the potential harm
• what measures you have identified to address the risks and whether they are eliminated, reduced or accepted taking into account the security measures applied

If a DPIA has been carried out which identifies a high risk and no measures can be taken to reduce that risk, you must consult the Data Protection Authority. You cannot proceed with the processing until you have done so.

Attention must be focused on the "residual risk" after mitigation measures have been taken. If the DPIA identified a high risk, but measures have been taken to reduce that risk so that it is no longer a high risk, there is no need to consult the Data Protection Authority.

A DPIA may deal with multiple processing operations that are similar in terms of risks, provided that due account is taken of the specific nature, scope, context, and purposes of the processing.

You should start assessing the situations to address when it is necessary to conduct a DPIA:

• who will conduct it?
• who else needs to be involved?
• will the procedure be centralized or performed locally?

If the processing is carried out wholly or partly by a data processor, that processor must assist you in performing the DPIA. It may also be appropriate to seek the views of data subjects in certain circumstances.

It is important to ensure that someone in your company or an external data protection consultant takes responsibility for data protection regulatory compliance.

It may be necessary to appoint a Data Protection Officer (DPO). Any company can appoint a DPO, but it is mandatory to do so if:

• it is a Public Administration, with the exception of judicial offices
• regular and systematic monitoring of individuals on a large scale is carried out, for example monitoring online behaviour
• large-scale processing of special categories of data or data relating to criminal convictions and offences is carried out

You may find it useful to voluntarily designate a DPO even when the GDPR does not require it.

The DPO should work independently, report to the highest management level, and have adequate resources to allow the appointing organisation to meet its obligations under the GDPR.

The minimum tasks of the Data Protection Officer are:

• inform and advise the company and its employees about their obligations to comply with the GDPR and other data protection laws
• monitor compliance with the GDPR and other data protection laws, including managing data protection activities, staff awareness and training, and conducting internal audits
• advise on and monitor personal data protection impact assessments
• act as the contact point and cooperate with the Data Protection Authority and provide support for any issues relating to data protection
• be the contact point for data subjects whose data is processed (employees, customers, etc.)

You should ensure that decision-makers and key people in your business are aware of the provisions of the GDPR.

Executives and managers should lead by example, demonstrating accountability for GDPR compliance and promoting a positive data protection culture within the company.

They should take a leading role in assessing any impacts on your business and encourage a privacy-by-design approach.

They should help raise awareness among all staff of the importance of exercising good data protection practices.

You must process personal data in a manner that ensures appropriate security. Before you can decide what level of security is acceptable, you must assess the risks to the personal data you hold and choose security measures that are appropriate for your needs.

Keeping IT systems safe and secure can be a complex task and requires time, resources, and specialist expertise.

If you process personal data on your IT systems, you must identify the associated risks and take appropriate technical and organisational measures to secure the data.

The measures you put in place should be tailored to the needs of your business. They do not necessarily have to be expensive or onerous, they could even be free or already available in your current IT systems.

A good starting point is to establish and implement a robust information security policy that details your approach to data security, the technical and organisational measures that will be implemented, and staff roles and responsibilities relating to information protection.

The GDPR introduces a requirement for all organisations to report certain types of personal data breaches to the Data Protection Authority and, in some cases, to data subjects.

A personal data breach means an accidental or unlawful breach of security leading to the destruction, loss, alteration, unauthorized disclosure of, or access to, personal data.

You must notify a personal data breach to the Data Protection Authority unless it is unlikely to result in a risk to the rights and freedoms of data subjects. Where a breach is likely to result in a high risk to the rights and freedoms of data subjects, you must inform them directly and without delay.

In all cases you must keep a record of personal data breaches, regardless of whether or not they are subject to notification to the Data Protection Authority.

You must report a breach that is required to be notified to the Data Protection Authority without delay, not later than 72 hours after having become aware of it. In some circumstances this period may be shorter. The GDPR recognizes that it will not always be possible to fully investigate a breach within that timeframe and allows you to provide additional information in phases, provided this is done without further delay. You should ensure your staff understands what constitutes a personal data breach, which has a broader meaning than just data loss.

You must ensure you have an internal breach reporting procedure in place. This will facilitate decision-making regarding the need to inform the Data Protection Authority or data subjects.

Given the tight timeframes for reporting a breach, it is important to have robust internal breach detection, investigation, and reporting procedures in place.

The GDPR imposes restrictions on the transfer of personal data outside the European Union, to third countries or international organisations.

These restrictions are in place to ensure that the level of protection for data subjects provided by the GDPR is not compromised.

Personal data can only be transferred outside the EU if the conditions for transfer set out in Chapter V of the GDPR are met.