#Basic data privacy principles how to

For most companies, getting slapped with a GDPR fine could be business-ending.

A violation, or non-compliance can cost companies 10M Euros or 2% of their annual revenue – whichever is higher. GDPR reigns supreme for its scope, scale and non-compliance fees. If you’re unfamiliar with the details, GDPR is designed to protect the data privacy of EU citizens through regulations aimed at companies who collect and/or process EU citizen data – regardless of what country they operate in. The regulation was introduced in 2016 and provided companies with a two year runway before coming into effect in 2018. The General Data Protection Regulation (GDPR) is one of the most well-known (and feared) data privacy and security laws on the planet. Leveraging data discovery, classification and reporting capabilities for principles alignment and compliance We design, carry out, report and document our data processing activities with adequate accuracy and openness, and we ensure that we have adequate policies and mechanisms in place to adhere to these Principles and other relevant data privacy and data protection instruments, including the UN Principles on Personal Data Protection and Privacy. We transfer data to third parties, provided that under the circumstances, we have satisfied ourselves that the third party affords appropriate protection for the personal data, consistent with the requirements of the relevant data privacy and data protection instruments and the United Nations’ global mandate. Technology Collaborators and Data Transfers

#Basic data privacy principles how to

This includes provision of information about the processing of their personal data as well as information on how to request access, verification, rectification, and/or deletion of that personal data, insofar as the specified purpose for which data is processed is not frustrated. We process data with transparency to the data subjects, as appropriate and whenever possible. We ensure that the risks and harms are not excessive in relation to the positive impact of the project. We take into consideration the impact that data processing may have not only on individuals but also on groups of individuals. We perform a risks, harms and benefits assessment and implement appropriate mitigation processes before any new or substantially changed data processing activity is undertaken. We also ensure proper protection of non-personal data, that is processed in a sensitive context and that may put certain individuals or groups of individuals at risk of harms. We employ stricter standards of care while processing data that relates to vulnerable populations and persons at risk, children and young people, and when processing any other sensitive data. We implement appropriate organizational, administrative, physical and technical safeguards and procedures to protect the security of the data, including against or from unauthorized or accidental access, damage, loss or other risks presented by data processing. We process data with due regard to confidentiality. We ensure that the data is accurate and, where necessary, up to date to fulfill the specified purposes. We only retain data for the time that is necessary for the specified purposes.

We do not attempt to knowingly and purposefully re-identify de-identified data, unless there is a legitimate and fair basis for doing so, and we make all reasonable efforts to prevent any illegitimate or unjustified re-identification. We ensure that the data we process is relevant, limited and adequate to what is necessary in relation to the specified purposes of data processing.

We do not process data in ways that are incompatible with such purposes. We process data for specified purposes, which are consistent with the United Nations global mandate and take into account the balancing of relevant rights, freedoms and interests. We process data in a fair manner, in accordance with the United Nations global mandate and governing instruments, and on the basis of any of the following: (i) the consent of the data subject (ii) the best interests of the data subject, consistent with the United Nations global mandate (iii) the United Nations global mandate and governing instruments or (iv) another appropriate legal basis specifically identified. The following principles apply whenever we collect, use, share, or otherwise process personal data or sensitive non-personal data as part of our activities: Fair and Legitimate Processing Our Data Privacy & Data Protection Principles