Search results

Home / Search

Category:
Select
Select

11269 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Applying ISO 9001 certification to a new entity within an ISO certified company

    No, you cannot use it. Your new operation in Norway is not included in the scope of the other certified systems of the company. So, you must first implement the management system and then your company can request the certification of the operation in Norway or include the Norwegian site in the scope of another certified site. In the second case, in the next recertification or surveillance audit, the Norwegian site will be included.

    Organizations shall define, document, and make available the scope of the QMS, referring to the Products and Services that are provided and identifying the limits of the management system. The scope should clearly describe the type of Products and Services covered by the system and provide sufficient information, preventing the transmission of erroneous or misleading information about what the organization covers in the quality management system and what it is able to provide to its customers. It must be available because it is through the scope that the organization communicates to the relevant interested parties, namely customers and potential customers, the Products and Services it makes available, and the locations involved.

    The following material will provide you information about the scope of a quality management system:

  • ISO 9001 and standardization of office documents

    ISO 9001:2015 is not about standardization of office documents. It is about the standardization of all documents relevant to the quality management system. It is not mandatory to apply the same standardization to occupational safety. However, I advise doing that. Later, if the organization wants to integrate together quality and occupational safety in the same management system, there is a common set of rules for document standardization.

    You can find more information about document control below:

  • Defining process flow requirements

    Let us consider clause 4.4.1 a) and b). There is no mandatory requirement to use a diagram format. However, in all my experience I only saw diagram formats. A possible way of answering your request could be:

    https://www.screencast.com/users/ccruz5284/folders/Default/media/e8d43db2-f45c-4a1f-8698-3012856b2b32

    You can find more information below:

     

  • EU GDPR representative

    "The client is a small company that is a staff of four or five. They are based in the US and provide neurologic brain testing for patients usually suffering from a stroke.  The tests are administered by a doctor or a health clinic.  Recently, there is a clinic in Italy that plans on using their software.  The number of patients, for the near future, may only be a few dozen.I have done some research but can't find an exact answer to these questions:1. Does the company need to have a formal EU Representative?

    Yes, the company needs to have a formal EU Representative because they are offering a service/product in an EU Member State.

    Are there companies that provide EU Representation services?

    Yes, there are consulting firms and lawyers specialized in GDPR and Data Protection laws that offer this service. The company needs an EU Representative located in the country where the service/product is offered as stated in article 27 paragraph 3 GDPR.

    Does this representative need to keep the Record of Processing Activities?

    Yes, article 30 GDPR requires that “Each controller and, where applicable, the controller’s representative, shall maintain a record of processing activities under its responsibility.” The Record is required because the project will involve health data, which follow under article 9 GDPR and need special protection (this category of data is also known as sensitive data).

    If there is one thing that must be focused on to be GDPR compliant, what would that be?"

    There is more than one thing to be focused on to be GDPR compliant, but thinking of your project, involving health data which is the particular category of personal data under Article 9 GDPR, I shall say consent and information to the data subject. Patients need to be informed and aware that their data will be processed and transferred to a US company (transfer shall comply with Standard Contractual Clauses) and of course the security of data processing. Information to data subject and safety of data processed is the core of GDPR. Our Toolkit helps organization implement GDPR requirements.

    Here you can find more information for starting to be compliant with GDPR:

    If you need to understand how to comply with GDPR, you can consider enrolling in our free online training:

    Here you can find all information about our EU GDPR Toolkit and the expert support: https://advisera.com/eugdpracademy/eu-gdpr-documentation-toolkit/

  • Joint controllers share of responsibilities in IoT

    Yes, because it processes the data of clients. Data subjects that purchase an IoT device accept the terms and conditions of that producer and provides personal data to that company. Of course, the producer may shift the liability with the IoT development company.

    Please, remind that GDPR does not apply only to IoT software but to all data processed by the company so there are more personal data than those acquired by the IoT device.

    The two companies can be the joint controller and there will be a data protection agreement where the liability profiles are separated so that the producer will bear responsibility for customer data (shipping, invoices, customer care, marketing, etc) while the software development company will bear responsibility for data processed through the IoT device.

    In case the producer of the IoT hires a software development company to design an IoT software giving specific of the software and having access to data and using those data for any purpose (product development, marketing, etc.) the IoT integrator will be the controller and the software will be the processor (for data processed through software) because all control over data is in the producer company.

    The following article may help you how to manage the obligation of controllers:

Page 219-vs-13485 of 1127 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +