3. GDPR

Question 1

What are the material scope of GDPR?

Answer 1

1. Processing personal data wholly or partly by automated means?
2. Personal data that forms part of a filing system, even if the processing is not conducted by automated means

Question 2

What are the territorial scope of GDPR?

Answer 2

1. When a controller or processor is established in the EU.
2. Of data subjects int he EU and related to offering goods or services or monitoring behavior 3
3. By a controller in a place where member state law applies

Question 3

What are the 6 legal basis for transferring personal data outside of EU?

Answer 3

1. Adequacy decisions
2. Ad hoc contracts
   3 Standard contractual clauses (SCCs)
3. Binding corporate rules (BCRs)
4. Codes of conduct and/or self-certification mechanisms
5. Derogations

Question 4

Under the 6 legal basis for transferring personal data, what does adequacy mean?

Answer 4

“Adequacy” means that the European Commission of the EU has deemed another country’s data protection laws “adequate” to safeguard its own data. See Article 45 of the GDPR for more information.

Question 5

Under the 6 legal basis for transferring personal data, what does Ad hoc contracts mean?

Answer 5

Ad hoc contractual clauses may also be used for GDPR compliance, although they must receive prior supervisory authority approval and thus may be a less attractive option for controllers.

Question 6

Under the 6 legal basis for transferring personal data, what does standard contractual clauses mean?

Answer 6

A standard contractual clause, also known as a model clause (language written into a contract), may be a way for organizations to facilitate international data transfers

Question 7

Under the 6 legal basis for transferring personal data, what does Binding corporate rules mean?

Answer 7

BCRs are legally binding internal corporate privacy rules for transferring personal information within a corporate group. They are typically used by corporations that operate in multiple jurisdictions. Under the GDPR, BCRs require approval from a
supervisory authority. At a minimum, BCRs must include structure and contact details for the concerned group, information about the data and transfer processes, how the rules apply to general data protection principles, complaint procedures and compliance mechanisms

Question 8

Under the 6 legal basis for transferring personal data, what does code of conduct/self-certification mean?

Answer 8

Under the GDPR, codes of conduct resemble the self-regulatory programs used elsewhere to demonstrate to regulators and consumers that a company adheres to
certain information privacy standards. Like codes of conduct, certification is available to controllers and processors outside the EU, provided they demonstrate, by contractual or other legally binding instruments, their willingness to adhere to the mandated data protection safeguards.

Question 9

Under the 6 legal basis for transferring personal data, what does derogations mean?

Answer 9

If no adequacy decision or appropriate safeguards exist, derogations may be used as a last resort in limited circumstances to allow organizations to transfer personal data across borders under specific conditions.

Question 10

What is a Controller?

Answer 10

Controllers determine the purpose and the means of processing data

Question 11

What is a processor?

Answer 11

Process personal data on behalf of a controller.