GDPR

Personal data shall be processed lawfully, fairly and in a transparent manner.

Processing of personal data shall only be lawful where one of the legal bases applies.

Where processing is based on consent, the controller must be able to demonstrate consent was given, consent requests must be clearly distinguishable and in plain language, and withdrawal must be as easy as giving consent.

When personal data are collected from the data subject, the controller shall provide specified information.

When personal data have not been obtained from the data subject, the controller shall provide specified information.

The data subject has the right to confirmation of whether their personal data is being processed and, if so, access to it plus specified information (purposes, categories, recipients, retention period, source, automated decision-making).

The data subject has the right to obtain rectification of inaccurate personal data without undue delay, and to have incomplete data completed.

The data subject can obtain erasure of personal data without undue delay on specified grounds (no longer necessary, consent withdrawn, unlawful processing, legal obligation, etc.), subject to listed exceptions.

The data subject has the right to receive personal data they provided in a structured, commonly used, machine-readable format and to transmit it to another controller, where processing is based on consent or contract and carried out by automated means.

The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects them, subject to specified exceptions and safeguards.

The controller shall implement appropriate technical and organisational measures designed to implement data protection principles.

Controllers must only use processors providing sufficient guarantees; processing must be governed by a contract covering subject-matter, duration, nature, purpose, security measures, sub-processor conditions, and audit rights.

Controllers and processors must maintain written records of processing activities (purposes, data categories, recipients, transfers, retention, security measures); enterprises under 250 employees are exempt unless the processing is risky, non-occasional, or involves special categories.

Controllers and processors must implement technical and organisational measures appropriate to the risk (pseudonymisation, encryption, resilience, ability to restore availability, regular testing), taking into account state of the art and cost.

Controllers must notify the supervisory authority of a personal data breach without undue delay, and where feasible within 72 hours, unless unlikely to result in risk; processors must notify the controller without undue delay.

When a personal data breach is likely to result in high risk to rights and freedoms, the controller shall communicate the breach to the data subject without undue delay (Art.34).

Where processing is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall carry out a data protection impact assessment.

Controllers and processors shall designate a DPO where required (public authority, large-scale systematic monitoring, or large-scale special categories); DPO contact details published and communicated to supervisory authority (Art.37).

Any transfer of personal data to a third country or international organisation, including onward transfers, may take place only if the conditions of this Chapter are complied with, so that the level of protection guaranteed by the Regulation is not undermined.

Administrative fines up to EUR 10 million/2% of global turnover for lower-tier infringements (e.g. Articles 8, 11, 25-39, 42, 43), or up to EUR 20 million/4% for higher-tier infringements (e.g. the basic processing principles, data subjects' rights, international transfers).