The GDPR requires you to document how you comply with legal principles.

A codified policy will help you manage data protection consistently and demonstrate accountability under the GDPR. This can be implemented by drafting a standalone policy or as part of a general personnel management policy.

The guidelines should clearly set out your approach to data protection along with responsibilities for its implementation and compliance monitoring.

Management should approve such a policy, publish it, and communicate it to all staff. You must review it and keep it updated at planned intervals or when necessary to ensure it remains fit for purpose.

It is important to ensure that someone in your company or an external data protection consultant takes responsibility for data protection regulatory compliance.

It may be necessary to appoint a Data Protection Officer (DPO). Any company can appoint a DPO, but it is mandatory to do so if:

• it is a Public Administration, with the exception of judicial offices
• regular and systematic monitoring of individuals on a large scale is carried out, for example monitoring online behaviour
• large-scale processing of special categories of data or data relating to criminal convictions and offences is carried out

You may find it useful to voluntarily designate a DPO even when the GDPR does not require it.

The DPO should work independently, report to the highest management level, and have adequate resources to allow the appointing organisation to meet its obligations under the GDPR.

The minimum tasks of the Data Protection Officer are:

• inform and advise the organisation and its employees about their obligations to comply with the GDPR and other data protection laws
• monitor compliance with the GDPR and other data protection laws, including managing internally managed data protection activities, staff awareness and training, and conducting internal audits
• advise on and monitor personal data protection impact assessments
• act as the contact point and cooperate with the Data Protection Authority and provide support for any issues relating to data protection
• be the contact point for data subjects whose data is processed (employees, customers, etc.)

You should document the internal analysis you performed to determine whether to appoint a DPO, unless it is obvious that your company is not required to designate one.

You should ensure that executives and people in positions of responsibility in your company are aware of the provisions of the GDPR.

Executives and managers at various levels should lead by example, demonstrating accountability for GDPR compliance and promoting a positive data protection culture within the company.

Executives and managers should take a leading role in assessing any impacts on your business and encourage a privacy-by-design approach.

Executives and managers should help raise awareness among all staff of the importance of exercising good data protection practices.

You should set out how you manage information risks.

This activity could be managed by the data controller to whom you are providing services, and you should ensure you cooperate with them so that any information risks you identify are brought to their attention regularly.

You need an expert profile to act as the manager of information risk management, coordinating the procedures put in place to mitigate them, system access policies, and IT asset risk assessments.

You should have appropriate action plans in place to mitigate any risks that have not been contained or resolved.

Prior to the commencement of a new contract, the data controller should complete a Data Protection Impact Assessment (DPIA) where circumstances require it. As a data processor, you should be ready to provide your input into this assessment and work with the controller to mitigate any identified risks. Having implemented an information risk management framework will help you do this effectively.

Under the GDPR, as a data processor, you have a general obligation to implement appropriate technical and organisational measures to show that you have considered and integrated data protection into your processing activities. This is referred to as data protection by design and by default.

You should adopt internal policies and implement measures that help comply with data protection principles, for example data minimization, pseudonymization, and transparency measures.

You must inform all staff handling personal data about their data protection responsibilities. It is good practice to deliver awareness training over time, upon or immediately after appointment and with updates at regular intervals or when required.

You should also consider specialist training for staff with specific duties, such as information security, database management, and marketing.

Regularly communicating relevant information is equally important to reinforce training and maintain awareness, e.g. via intranet, circulars, meetings and posters.

Whenever you process personal data, you must have a written contract or other legally valid act in place with the data controller.

The contract is important so that both parties understand their legal responsibilities and obligations.

The GDPR sets out what must be included in the contract, including the obligation to act only on the written instructions of the controller.

Although the data controller is ultimately responsible for overall compliance with the GDPR and for demonstrating that compliance, as a data processor you have some direct obligations and responsibilities.

Failure to comply with any of these obligations, or acting outside of or contrary to agreements, could result in you being liable to pay damages in legal proceedings, or being subject to fines or other penalties or corrective measures.

You could consider signing up to an approved code of conduct or certification scheme to demonstrate to the data controller that you have been chosen as a processor because you are qualified for the role. However, these are not yet available for all sectors.

Standard contractual clauses could be provided by the European Commission or the Data Protection Authority and form part of a code or certification scheme. However, these are not yet available for all sectors.

You can only engage another data processor as your sub-processor if you have prior written authorization from the data controller.

You must enter into a contract, or other legal act, with the sub-processor that imposes specific obligations on that sub-processor.

As a data processor, you are responsible to the data controller for the fulfilment of your sub-processor's obligations.

Prior authorization to use a sub-processor can be specific or general. However, if general, you must inform the controller in advance of any intended changes concerning the addition or replacement of other sub-processors, so that the controller has the opportunity to object.

Under the GDPR, if your company is located outside the EU and offers products and services to EU citizens, then you must designate in writing a representative within the European Union.

You can transfer personal data outside the EU in accordance with the conditions for transfer set out in Chapter V of the GDPR.

The GDPR introduces a duty on all data processors to notify data controllers of a personal data breach "without undue delay" after becoming aware of it. It is therefore important to have procedures in place to detect and report both internal and external breaches.

A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.

You should make sure your staff understands what constitutes a personal data breach, and that this is much more than just losing personal data.

Data subjects have the right to obtain:

• confirmation that their data is being processed
• access to their personal data
• other supplementary information: this largely corresponds to the information the controller must provide in a privacy notice

You must have robust procedures and assign responsibilities within your company to collate and manage such requests in a timely manner, regardless of whether they are directed to you or the data controller.

If all data processed has been identified and documented, it will be easier to locate and retrieve specific information as requested by the data controller. Information must be provided to the requester by the data controller without delay and at the latest within one month of receiving the request, extendable by a further two months for complex or numerous requests. In that case, the data subject must be informed and given an explanation.

If the request is made electronically, the data controller may require you to send them the data in a commonly used electronic format.

You should establish timeframes for your response to a data subject information request as a clause within your written contract with the data controller.

Data subjects have the right to have data rectified if it is incorrect or incomplete.

You must implement procedures that allow you to respond to a request from a data controller to correct inaccurate data within one month.

It is good practice to mark disputed data as inaccurate or incomplete and state the reasons why.

If the personal data has been disclosed to others, you must contact each recipient and inform them of the restriction on the processing of such data, unless this proves impossible or involves disproportionate effort. If requested, you must also provide information about these recipients to the data subjects.

You need to periodically review the data processed or stored on behalf of a data controller to determine when certain operations, such as correcting inaccurate data, need to be performed. It can help to adopt records management policies (including email address lists) with clear rules for their creation and retention.

Conducting regular reviews of data quality in digital and paper systems will help you ensure that the information continues to be adequate for the purposes of the processing in accordance with what is set out in the contract with the data controller.

You should also ensure you complete regular data quality checks to provide assurance on the accuracy of the data your staff is entering into processing systems.

If you identify data accuracy issues, you must communicate these findings to staff through awareness campaigns and ongoing training.

Data subjects have the right to be forgotten (the so-called right to erasure) and can request the data controller, and consequently you as the processor, to delete their personal data when:

• it is no longer necessary for the purpose for which it was originally collected and processed
• the data subject withdraws consent for its processing
• the data subject objects to the processing of their data and there is no overriding legitimate interest to continue processing it
• it has been unlawfully processed (i.e. in breach of the GDPR)
• it has to be erased to comply with a legal obligation
• it is processed for information society services directed to minors

You should pay particular attention to situations where a child has given consent to processing and subsequently requests the deletion of the data (regardless of their age at the time of the request), especially on social networking sites and internet forums. This is because a child may not have been fully aware of the risks involved in the processing at the time of consent.

These requests will initially be received by the data controller. However, if you also process and store such data, you must have the appropriate procedures in place to ensure its permanent deletion within one month of receipt.

You must have standard contractual clauses regarding data deletion, retention, and disposal. You should ensure these conditions are met. A written retention policy will remind you when to dispose of the various categories of data and help you plan their safe disposal.

Data subjects have the right to block or restrict the processing of their personal data.

When processing is restricted, you are only allowed to store the personal data, to the exclusion of any other operation. You may only retain sufficient information to assure the data subject that the restriction is respected in the future.

The data controller may require you, in your capacity as data processor, to restrict the processing of personal data if:

• the data subject contests the accuracy of the personal data
• the data subject has objected to the processing, where it was necessary for the performance of a task carried out in the public interest or for a legitimate interest of the controller, and the controller is considering whether these interests override those of the data subject
• the processing is unlawful, but the data subject opposes the erasure of the data and requests a restriction on its processing instead
• the personal data is no longer needed by the data controller, but the data subject requires the data to be kept in order to establish, exercise, or defend a legal claim

You must comply with requests within one month of receipt.

The right to data portability allows data subjects to obtain and reuse their personal data for their own purposes across different services.

Data subjects can receive personal data, move, copy, or transfer it easily from one IT environment to another in a safe and secure way, without hindrance to usability.

The right to data portability only applies:

• to personal data provided by an individual to a controller
• if the processing is based on the data subject's consent or for the performance of a contract
• if the processing is carried out by automated means

You must comply with requests without delay and in any event within one month of receipt. Because the data controller may receive such a request, you should be able to provide them with all data processed on their behalf so they can fulfil the portability request received from the data subject.

You must provide the personal data in a structured, commonly used and machine-readable format. Examples of appropriate formats include CSV and XML files.

You must provide the information free of charge. If the data subject (and therefore the controller) requests it, you may be required to transmit the data directly to another organisation where technically feasible.

You must process personal data in a manner that ensures appropriate security.

Before you can decide what level of security is acceptable, you need to assess the risks to the personal data you hold and choose security measures that are appropriate for your needs.

Keeping IT systems safe and secure can be a complex task and requires time, resources, and specialist expertise.

If you process personal data on your IT systems, you must identify the associated risks and take appropriate technical and organisational measures to secure the data.

The measures you put in place should be tailored to the needs of your business and do not necessarily have to be expensive or onerous. They could even be free or already available in your current IT systems.

A good starting point is to establish and implement a robust information security policy that details your approach to information security, the technical and organisational measures that will be implemented, and staff roles and responsibilities regarding data protection.