There are six phases to go through in order to analyze whether a legitimate interest exists for the company (or a third party that is the data controller). If the analysis results in the existence of a legitimate interest in the processing, the company may carry out processing of the personal data. Legitimate interest is […]
A company in Poland received a fine for failure to report personal data breaches in a timely manner. The company has stated that this was due to a human error. In this case, the company had to report the breach within 24 hours of the discovery of the incident. But the company submitted the notification
Failure to report personal data breaches in a timely manner Read Post »
All companies must delete personal data regularly in accordance with the GDPR, also known as the erasure of personal data. The GDPR stands for the General Data Protection Regulation (EU) 2016/679. According to the general rule of the GDPR, a company shall delete personal data when they are no longer necessary to process for the
There are situations when it may be appropriate to use legitimate interest as the legal basis for personal data processing. A company may want to send marketing emails to its former customers. This is an example of when it would be appropriate to use legitimate interest as the legal basis. In this marketing activity, the
When it may be appropriate to use legitimate interest Read Post »
Companies that obtain consent from children are subject to stricter requirements than companies that obtain personal data from adults. It is permissible for children to give their consent to the processing of their own personal data. This is applicable in connection with certain services under the General Data Protection Regulation (EU) 2016/679 (GDPR). A Company may according
There is certain specific information to be provided when obtaining consent from a person. The information shall be provided before the company process their personal data. Companies must, among other things, inform about the purpose of the processing of personal data. The company shall provide the information when they obtain the consent from the data
Information to be provided when obtaining consent Read Post »
There are different situations when a company should not use consent as a legal basis for processing personal data. There are different articles of the General Data Protection Regulation (EU) 2016/679 (GDPR) that regulates consents, such as Article 6(1)(a) and Article 7. According to Article 6 of the GDPR, a company must have a legal
When a company should not use consent as a legal basis Read Post »
A consent must be voluntary and actively given for it to be valid under the General Data Protection Regulation (EU) 2016/679. Consent is one of the six legal bases that a company can use when processing personal data. Some people believe that consent is required to process personal data, but this is not true. Personal
A consent must be voluntary and actively given according to GDPR Read Post »
