GDPR

Question 1

What Data Subject Can Do?

Answer 1

• Withdraw Consent
• Request a copy of their personal data to move to another organization or to be deleted.
• Object to automated decision-making processes.
• Request controllers to “freeze” processing of their PII
• Influence Regulators

Question 2

What Organizations Must Do?

Answer 2

• Implement Privacy by Default & Privacy by Design
• Maintain appropriate data security
• Notify data subjects & regulators of data breaches
• Follow special rules for directly processing children’s data
• Provide notice of intention to process personal information

Question 3

What Organizations Must Do? Part 2

Answer 3

• Appoint a Data Protection Officer
• Take responsibility for processing activities of 3rd party vendors
• Conduct data protection impact assessments
• Ensure adequacy or appropriate safeguards for data transfers
• Consult with regulators before processing personal data
• Keep records and demonstrate compliance

Question 4

What Regulators May Do?

Answer 4

• Ask for records of compliance i.e., DPIAs, Risk Analysis, DPA
• Impose temporary data processing bans, require breach notification, and order erasure of PII
• Suspend international data flows
• Enforce penalties of up to $20mil or 4% of annual revenue for non-compliance