Key Takeaways:
The EU’s General Data Protection Regulation (GDPR) permits users certain rights (referred to as “data subject access rights” or “DSARs” in the documentation) that organizations will need to be prepared to accommodate if they must comply with GDPR.
These rights are legally enforceable and aim to give users control of their personal information. These rights include…
Data subjects are also required to be informed of their access rights.
After processing is restricted, data subjects’ personal data may only be processed under certain conditions or when the data subject consents to processing.
Without a clear understanding of DSARs and how your organization will respond, you may risk consuming too much time, money, and resources in efforts to remain compliant.
Regardless whether you’re a controller or processor, you’ll have to respond to these requests to remain compliant. Here are six considerations on how to prepare and respond when a customer chooses to request action on one of their new rights under GDPR:
The GDPR defines personal data as “any information relating to an identified or identifiable natural person.”
Understanding what information your organization retains that may fall under that definition and where that information resides on your network and systems is not only a critical step to compliance under GDPR but also being able to respond to a data subject request.
The GDPR specifies that requests must be responded to “within one month of receipt of the request.” To meet this timeframe, you must first know where that data resides.
Providing a simple, clear, and/or automated method for users to request and receive information on their request will not only keep you compliant, but it will also simplify the request process to require a minimum of personnel involvement.
At a basic level, this could include a clearly-displayed email address on your site through which data subjects can send access requests. Another option is a form on your company’s site that includes all the required information you will need to process the request, i.e., contact information, validation credentials, and information being requested.
Regardless which method you choose, remember that the GDPR mandates a 30-day timeframe for a response to these requests. So, favor expedient methods or digital communication over traditional mail or slower communication wherever possible.
Finally, designate appropriate personnel to identify and manage the lifecycle of DSARs to ensure completion of every request within the 30-day timeframe.
Article 12 permits that “where the controller [or processor] has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller [or processor] may request the provision of additional information necessary to confirm the identity of the data subject.”
Ensure you have mechanisms in place to confidently verify user identity before providing any requested information. This could include requiring requesters to answer security questions, provide other identifiers related to their account, or even sending a confirmation text message to the phone number associated with the data subject.
Compliance with DSARs will require cooperation between all departments. The IT Department may be unaware of certain data locations or of specific types of data processed or stored by each department. By working collaboratively, all departments can be sure they are pulling their weight, and those in leadership positions can rest assured they’re not leaving any gaps in the process.
Like any compliance framework or regulation, the GDPR will require implementation of formal processes to accomplish compliance.
Article 24 requires that “…the controller [and processor] shall implement appropriate technical and organizational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary.”
While you may be tempted to wait until the GDPR goes into effect to define and document these processes, we recommend you begin immediately. You might try to respond to requests on an ad-hoc basis, but documenting the process beforehand will enable you to demonstrate that processing is performed in a compliant manner and simplify the process as much as possible.
The review process should be used to ensure the organization is providing the appropriate information to the requester and that no proprietary or irrelevant information is inadvertently released.
Before marking a request as “complete,” perform a review to ensure that the data subject’s request has been met. This will differ between different requests.
For example, if the request was the erasure of personal data, you might perform a final database search to ensure that no personal information of the requester remains.
If the request was a release of personal data to the data subject, you may review the information being released to ensure that no proprietary data or personal data of other data subjects is included and that the personal data released is in “a structured, commonly used and machine-readable format…”
Or, if the request is the restriction of processing or objection to processing, you’ll need to ensure you have implemented processes to prevent processing at all points in the data flow for that particular data subject.
Seamless compliance with the GDPR requires more than a rote implementation of processes. It requires analysis of current processes and conscious implementation and documentation of new ones.
Contact us today, and we’ll guide you through GDPR compliance, helping your organization create processes that not only promote compliance but simplicity as well.
