Search results

Home / Search

Category:
Select
Select

11294 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Handling data according to EU GDPR

    "If we are coordinating a European project, and the data we collect is basic personal data (name, phone, email) from different EU city employees who take part in that project, are we, as a coordinator, responsible for how other project partners handle this data? i.e. the project makes us ensure that many partners also view this data (it wouldn't serve a purpose if we anonymize it) and then how can we control what the partner organisations do with this data, whether they delete it on time, etc.? so far we had a project document called DP management, where we would write down procedures, including that the data needs to be deleted after the project ends and so on.

    You need to evaluate if your project partners process data on your behalf, you can be considered as the leader of the project, and therefore they will be seen as a data processor. In this case, you need to appoint them and determine procedures, controls, and require compliance with your policies. 

    Your partners may be seen also as a joint controller, under article 26 GDPR, if they determine with you the mean and the purposes of data processing. In this case, you can make a data processing agreement and determine jointly policies to follow. Each will be accountable for the data processed by its company.

    Is this enough to show our accountability as coordinators?

    If your partner is a data processor, you need to appoint them as a data processor with a data processing agreement. Article 28 GDPR requires a written legal undertaking. Of course, you can demand to follow your policies and rules and also control if they comply with it.

    Here you can find more information

    If you want to know more about GDPR compliance you can consider enrolling in this EU GDPR Foundations Course: https://advisera.com/training/eu-gdpr-foundations-course//

  • Minor nonconformities

    ISO 27001 does not prescribe that Nonconformities must be graded, so you can treat all of them only as Nonconformities in the internal audit. The use of minor and major Nonconformities are more used for certification bodies as a best practice.

    Considering that, for certification purposes, you only need to ensure that any nonconformity is remediated by the time of the next surveillance/certification audit and that there is no recurrence of the same situation.

    This article will provide you with a further explanation about nonconformities:

    For further information, see:

  • Preparing site for first-time audit

    Site preparation depends on the type of production you have for your medical device. If that is a sterile medical device, then a lot of attention needs to be on the cleanliness of the premises. It means for example: the separate entrance of the raw material and exit of the finished product, special rules for clothing and behavior in the facility (protective clothing and other equipment, not allowed to eat or drink in the production area).

    If you produce a non-sterile device, then also there must be special attention to the work environment which is applicable for that kind of device. 

    If you produce software, rules for the work environment are less important, although it is important for the server room to have proper temperature and humidity. 

    In the warehouse, you need to have a properly labeled place for non-conforming products. 

    Other elements that cover site preparation mean that you need to have everything properly labeled, eg. shelves, lockers, locations in the premises.

    For more information on this topic, please see the following articles:

Page 277 of 1130 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +