Everything you need to know about GDPR

This article covers everything you need to know about GDPR to be able to handle compliance tasks for your company.  

The article is for you, who are the internal GDPR responsible and have the responsibility to ensure that your organization is compliant and complies with the General Data Protection Regulation, which came into effect in 2018. 

The aim of this article is to provide you with a comprehensive overview of the concepts and legal requirements that you need to be aware of and to ensure that your organization complies with them. 

When can you process personal data?  

When processing personal data, there are 7 basic principles that you must always comply with as a data controller. All GDPR requirements are based on these principles, which is why it is important to have an understanding of them. You should be aware that compliance with these principles does not constitute a legal basis for your organization's processing activities. The legal basis can be found in the other legal provisions of the regulation.  

The 7 basic GDPR principles (Article 5): 

1. Lawfulness, fairness and transparency. 
2. Purpose limitation.
3. Data minimization.
4. Accuracy.
5. Storage limitation. 
6. Integrity and confidentiality. 
7. Accountability. 

1. Lawfulness, fairness and transparency. 

Processing of personal data must be lawful, meaning that your organization must have a valid legal basis in national or EU law to process personal data. For example, the data subject has given consent to the processing of personal data under Article 6(1)(a) or Article 9(2)(a). The lawfulness principle also requires that the purpose of processing must be lawful. 

Fairness means that the data subject's information must be processed in a fair manner. It is not enough that the processing is lawful, it must also be fair to the data subject. Fairness involves protecting the interests of the data subject. This is an expression of the unwritten principle of good data processing practice. 

Transparency means that your organization must clearly communicate what, how, and why you are processing the data subject's personal data. The data subject must be made aware of the risks, rights, rules, and guarantees of the processing in a transparent and understandable way. It is important to communicate in a simple and easily understandable language. 

2. Purpose limitation 

When personal data is collected, the data controller must describe the purposes for which the data is being collected. The data may only be processed for the stated purpose. This means that you may not process the personal data for any other purpose, than the original purpose for which it was collected. The purpose of the processing must be determined prior to the start of the processing activity. The purpose must also be reasonable, which means that the purpose must be legal and within the reasonable scope of your organization. In determining whether a possible disclosure of personal data can be accommodated within the original purpose, the "not incompatible" test under Article 6(4) et seq. of the GDPR and Section 5(2) of the Danish Data Protection Act can be carried out. 

3. Data minimization 

The collected personal data must be sufficient, relevant, and limited to the purpose of the processing. Therefore, it is important that you do not have more information than necessary to fulfill your purpose. 

4. Accuracy 

It is important to ensure that the personal data being processed is accurate. If necessary, the information must be updated, and incorrect data must be updated or deleted immediately. 

5. Storage limitation 

Personal data must be deleted or anonymized when it is no longer necessary to retain them. If the information is still used for the original purpose, it is not necessary to delete it. 

6. Integrity and confidentiality 

Personal data must be protected against unauthorized or illegal processing. It must also be ensured that information is not lost or damaged. To ensure this, your organization must have implemented appropriate organizational and technical measures. 

7. Accountability 

The data controller is responsible for ensuring compliance with the GDPR principles mentioned above. It is also important that you can demonstrate that your organization complies with these principles. However, the regulation does not specify how to document compliance. Nevertheless, the regulation sets out some formal requirements for certain documentation, such as Article 28(9), which states that data processing agreements must be in writing and electronic. The same requirement applies to records under Article 30. 

What is personal data? 

Personal data is any form of information that can be attributed to a specific person. 

The following information is identifiable: 

• Social security numbers.   
• Fingerprints.
• Location data.   
• Payment information.   
• Medical records.  

When it is practically possible to identify a person from the information or in combination with other information, the information can be characterized as "personally identifiable". 

There are three categories of personal data in the GDPR: 

• Ordinary personal data (non-sensitive information).  
• Special categories of personal data (sensitive information).  
• Criminal convictions and offenses. 

Ordinary personal data (non-sensitive information) 

Regular personal data are all the information that are not classified as sensitive personal data. This could for example be: 

• Identification information such as name, address, age, and education.   
• Economic conditions.  
• Family relationships.  
• Housing.  
• Social problems.  
• Application and resume. 

Special categories of personal data (sensitive information)  

The special categories of personal data are expressly defined in the data protection regulation, and they include information about:  

• Race and ethnic origin. 
• Political opinions. 
• Religious or philosophical beliefs. 
• Trade union membership. 
• Genetic data. 
• Biometric data for the purpose of uniquely identifying a person.  
• Health-related information. 
• Sexual life or orientation. 

Only the information mentioned above constitutes special categories of personal data. 

Convictions and criminal offenses  

Information about criminal offenses is separately regulated in data protection law. This could be information that a person has committed a certain criminal offense. 

The GDPR regulation refers to the need to find a legal basis for the processing of such information in national legislation such as the Danish Data Protection Act. 

National identification number  

What is a processing activity?  

Examples of internal processing activities:  

• Payroll.   
• Recruitment and applications. 
• HR administration. 

Examples of external processing activities: 

• Sending newsletters.  
• Customer administration.    
• Cookie consent. 

It may involve processing of both ordinary and sensitive personal data, as well as internal information on employees and external information on customers and suppliers. 

Documentation of processing activities 

One of the most important requirements in the GDPR legislation is that if your company processes personal data, you must document your processing activities. A processing activity can be seen as a "work process in which personal data is processed". 

Documentation of your processing activities aims to comply with the "Principles for processing of personal data", “Keeping a record of processing activities" and "risk assessment of processing activities". Therefore, processing activities can be considered as the foundation for your further work with GDPR. 

Registration of processing activities

Registration of processing activities can be done in a static document or in a cloud-based platform where there is an opportunity to work dynamically with the entered information. 

What is a data controller?  

The regulation defines a data controller as: "A natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data." The data controller determines the why (the purpose) and how (the means) of the processing of personal data. It is also the data controller's responsibility to ensure that there is a legal basis for the processing and that the rights of the data subjects are observed and respected. 
 

What is a data processor?  

The regulation defines a data processor as: "A natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller." The data processor processes personal data on behalf of the data controller and operates under the responsibility of the data controller. If the data processor acts outside of the instructions (and thus outside of the data processing agreement), they become an independent data controller. However, this does not mean that the original data controller cannot be held accountable to the data subject. It is the data controller's responsibility to monitor the data processor (and the data controller is responsible for what the data processor does). 

The data processor is responsible for complying with the data processing agreement with the data controller. 

What is a sub-processor?  

The data processor has the option to pass on one or more tasks to a sub-processor (subcontractor). The sub-processor has at least the same obligations as the data processor. 

The data processor may only use a sub-processor if the data controller has given written approval. Additionally, it is important to emphasize that the sub-processor acts on behalf of the data controller and not on behalf of the data processor. This means that the data processor does not become a data controller for the sub-processor. However, the data processor is responsible for the data protection obligations that the sub-processor has. If the sub-processor does not fulfill these obligations, it is the data processor's responsibility to fulfill these obligations on behalf of the data controller. 

It is important that the responsibility is clearly defined in the data processing agreement. 

What is a data processing agreement?  

It is a legal requirement that as a data controller, you enter into a data processing agreement with all your data processors. The data processing agreement describes how the data processor may process personal data on behalf of the data controller, ensuring that data is processed correctly and securely. The agreement is a legally binding document and must be in writing, including electronically. The agreement must meet certain minimum requirements to be considered valid. 

Minimum requirements for the data processing agreement 

1. The data processor may only process personal data according to documented instructions from the data controller.  
2. The data processor must ensure that authorized persons who process personal data have committed to confidentiality or are subject to an appropriate statutory duty of confidentiality.   
3. The data processor implements technical and organizational measures to ensure a level of security appropriate to the data controller's risk assessment. 
4. The data processor complies with the conditions for the use of sub-processors.  
5. The data processor assists the data controller as far as possible in responding to requests from data subjects, such as for access, erasure or rectification.  
6. The data processor assists the data controller in ensuring data processing security, notifying the supervisory authority/data subject about breaches of personal data security and preparing impact assessments.  
7. The data processor deletes or returns the personal data to the data controller upon the data controller's choice.  
8. The data processor makes all information necessary to demonstrate compliance with the data processing agreement available to the data controller and notifies the data controller if an instruction, in the data processor's opinion, conflicts with the regulation.  

The Data Protection Agency provides guidance on how to prepare a data processing agreement. For example, you can use the Data Protection Agency's template to prepare your company's data processing agreement and refer to Article 28(3) of the GDPR for further elaboration. 

Supervision of data processors    

According to the GDPR legislation, as a data controller, you must supervise that the data processor complies with the data processing agreement. Therefore, it is not sufficient to simply have entered into a data processing agreement. You can read more about supervision of data processors here.