• Have you considered what information comes into, goes through, or leaves your business?
• Does this information include personal data about your customers? This could include names and addresses of people you deliver to, contacts you use for telemarketing, personal details acquired when signing up for your services.
• Do you know why you collect and store personal data?
• Have you taken note of the personal data you hold, what you do with it, and why you keep it?

To be lawful, the processing of personal data must fall under one of the six criteria provided by law. This interactive online tool can be a valid guide regarding the conditions on which the processing carried out is based.
Your personal data collections include the following information:

• The type of data you possess, such as names and email addresses.
• How you obtained the data, for example on paper forms or via your website.
• Why you possess the data.
• How long the data processing will last and for how long it will remain in your possession.
• Whether you share personal data with others.
• Whether the data belongs to special or sensitive categories, such as medical information.

• Do you provide information to data subjects about the use of their personal data?
• Do you inform data subjects if you share their personal data with other individuals or organisations?
• Do you inform data subjects of what you intend to do with their personal data verbally or in writing, using flyers or posters, or online via a notice or privacy policy?

If you provide information to data subjects, remember that to be valid, the privacy notice regarding the processing of personal data must contain at least the following information:

• The name of the business or company and the person responsible for data protection.
• Why you hold personal data (and on what legal basis the processing relies) and what you do with it.
• Where you got the data.
• Who you share the data with and how you do it, including any sharing outside Italy and the European Union.
• How long you keep the data.
• How people can request access to their data or its correction or deletion.
• How to file a complaint or report to the competent Supervisory Authority.
• Whether you make automated decisions or profile based on the data you possess.

• Do you collect and use only the personal data you need to work?
• Do you ensure that people know the difference between the information they must provide and what is optional?

Example: For his window cleaning business, Eliot Ness collects the names and addresses of his customers, which he needs to clean their windows once a week. He would also like to collect his customers' email addresses to digitally send some special gutter cleaning offers instead of putting a flyer in their mailboxes. Since this is not necessary for performing his services, he informs his customers that providing this information is optional.

• Have you decided and documented how long you will keep the collected personal data?
• Do you update or destroy personal data after certain time periods?
• Do you securely delete or destroy personal data as soon as they are no longer needed?

Example: For his newsagent business, George Stone collects his customers' names, addresses, and phone numbers, as well as their weekly newspaper orders and payment details. He creates a document detailing what personal data he collects and how long he keeps it (establishes the retention period). At the end of the retention period, he securely deletes the data by destroying it. He also annually checks the personal data he holds to ensure that everything has been deleted at the end of the retention period.

• Do you regularly check that the personal data you hold is accurate and up-to-date?

Example: Rick Deckard is the manager of a local football team. Every month he sends an email to the team regarding upcoming matches. He should regularly check with team members that their email addresses are still accurate.

• Can you quickly update the information you hold if requested by the data subject?

• Do you keep personal data safe in the office, for example by using lockable filing cabinets and locking or logging out of computers when you are away from your desk?
• Do you take measures to protect personal data before taking it out and sending it elsewhere? For example, do you only carry the data you need or send it in advance using secure methods?
• Do you protect paper documents, for example using lockable archives and disposing of them securely?
• Do you protect electronic data, for example by encrypting mobile devices, using passwords, and backing up data?

• Do you know the rights of individuals established by the legislation?

In summary, these are the following:

• The right to be informed: to know what data you hold and what you do with it.
• The right of access: to be able to request a copy of their data that you hold.
• The right to rectification: to correct inaccurate data.
• The right to erasure: to ask you to delete or destroy their data.
• The right to restrict processing: to limit the amount or type of data used.
• The right to data portability: the ability to request the electronic transfer of data to another company.
• The right to object: to be able to request to stop using their data.

• Do you have programs in place so you can handle any eventual requests?
• Do you know that a request can be made in writing or verbally, in person, or over the phone?

A request can be made by phone, via email or in person, and does not necessarily have to be formally written. If possible, treat easily manageable requests as routine matters, in the normal course of your business. Here are two examples:
Jack Driscoll, a local football team manager, receives a call from a player requesting details of all the matches he has played in the past year. This can be handled without special procedures.
Carl Denham, the newsagent, is asked by a customer in the newsstand for his account balance. This request can be dealt with immediately without formalities.
For more complex cases, you will probably want to process requests more formally. Here are two examples:
One of Ann Darrow's former employees requests a copy of the references she provided about him to a potential new employer.
Rick Blaine manages the under-10 football team and receives a request from one of the children's parents for a copy of the information regarding their son.

• Do you know how long you have to respond to a request?

Data subjects' requests must be fulfiled as soon as possible and at the latest within one month of receiving them. The period starts from the day following receipt of the request. This period can be extended by two months taking into account the complexity and number of requests; in this case, a reasoned communication must be sent to the data subject within the initial expected limit. For example:
Ilsa Lund receives a request on September 3. The period starts from the following day, so the deadline to fulfil the request will be October 4.
Lynn Bracken, on the other hand, receives a request on May 5 that requires complex operations to be fulfiled. She decides to inform the data subject by June 6 that she needs another month to fulfil it, so the deadline falls on July 6.

• Are you able to delete someone's information if the data subject asks you to?

Jack Vincennes processes personal data to send direct marketing material by post. Since people have the right to erase their personal data, he ensures he can delete them within a month if necessary.

• Have you adequately trained the individuals under your employ who process personal data about their data protection responsibilities?

Example: Bud White is a builder and employs two people in his administrative office. He has informed them on how to keep information safe and secure, explained what privacy information he provided to his clients, and told them what to do if something goes wrong or data goes missing. He also hung a poster in the office with rules and procedures, and established a weekly check to verify that personal data is securely protected.

• Do you know what to do if something goes wrong, including a personal data breach?

A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. This includes breaches that are the result of both accidental and deliberate causes. It also means that a breach does not simply represent the loss of personal data.

• Do you know which breaches to report to the Data Protection Authority?

A breach can have a range of adverse effects on individuals, including emotional distress as well as physical and material damage. You must establish the likelihood and severity of the resulting risk to people's rights and freedoms. If a risk is likely, you must inform the Authority.

• Do you know which breaches you must inform the data subjects about?

If a breach is likely to result in a high risk to people's rights and freedoms, the GDPR states that you must inform the affected individuals directly and without undue delay. In other words, as soon as possible.