Get a 20% discount on the first year of the Company Training Academy annual plan.
Limited-time offer – ends April 24, 2025
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Retention period and Data processor agreement
1. Retention period – we are looking into the data retention period and would like to know if it is a must to define maximum retention period. We mainly process the job application data. Will it be a violation if we get consent from candidates that “we will keep the data for as long as the candidate wants us to source for employment opportunities”? -
Personal Data Protection Policy
Why Personal Data Protection Policy is a top level management ? To demonstrate the fulfillment of obligations of Data controller? -
Privacy Policy vs. Privacy Notice and Data breaches
I would love to ask you a few questions about GDPR. -
How telecom companies appoint DPO and Data Processor
Our company is a telephone company with about 1,500 customers to whom we invoice every month telephone traffic. We need to know if it is obligatory to name two figures mentioned in the GDPR: -
EU GDPR requirements for US based company
We are a US based company that has EU clients but we do not have an EU location or EU based employees. Are there any differences in the mandatory GDPR requirements since we do not have an EU location or employee? -
Legitimate interest
We know all the legalities of it, but it is not clear to us if we can claim legitimate interest to market certain people that voluntarily subscribed to, for instance, our webinars. -
DPA in EU
For a company based in Japan, other than complying to the GDPR law, do we have to report to a DPA in EU even if our company is only based In Japan? If yes who do we contact? -
Keeping personal data of clients
Hello, being in the hotel industry, it is important to recognize a repeater guest. But I understand that personal data of clients should not be kept once they are no longer our customers. Is there any provision for such case in the GDPR? -
Questionnaire
Trying to identify if as a controller we need to send a questionnaire to our processors or is putting a DPA with there assurances they are compliant sufficient? -
10 days period
Where do the 10 days for the identity check in the request for information come from? This can be found in the flowchart "Flowchart of the request for access of data subjects" in the block "No response within 10 working days"?