Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11270 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
GDPR and the territorial scope
Answer:
Switzerland is not a country where the GDPR would be applicable by default however the GDPR has an extraterritorial component meaning that the EU GDPR is also applicable to entities established outside the EU if they offer goods or services to individuals in the Union, or if they monitor the behavior of individuals in the Union (i.e., profiling activities, tracking individuals’ activities on the internet, etc.).
This basically means that companies in Switzerland may be caught by the GDPR.
The key to understanding when EU GDPR is applicable is understanding the meaning of “in the Union.” The EU GDPR will only apply to personal data regarding individuals within the Union, while the nationality or habitual residence of those individuals is irrelevant. For example, a company based in the EU which is processing the data of Japanese individuals located in Japan will still need to comply with the EU GDPR. Consequently, the Japanese individuals will be benefiting from all rights according to the EU GDPR, even if these rights do not exist in their own nation’s laws.
When the data of EU citizens is processed outside of the EU by companies which are also outside the EU, then this is not considered to be “in the Union”. For example, the EU GDPR will not be applicable for a school which is based in the United States just because there is a possibility that one or several of its students would be EU citizens. In this case, the processing does not take place “in the Union,” nor is the individual “in the Union”.
If you want to find out more about the extraterritorial reach of the EU GDPR check out our EU GDPR Foundations Course (https://advisera.com/training/eu-gdpr-foundations-course//) -
GDPR and marketing emails
Answer:
Based on your description you will be sending marketing emails to a potential client database. In this case, it is very important that whoever provides you the database can also be able to prove that the persons in the database have provided their consent to be approached for marketing reasons.
If you want to find out more about consent and marketing check out this webinar “How GDPR affects marketing practices” (https://advisera.com/eugdpracademy/webinar/how-gdpr-affects-marketing-practices-free-webinar-on-demand/) -
Subcontracting design and development
Just one more thing, with the 2015 version is it still necessary to have a quality manual?'
Answer
ISO 9001:2015 does not require a quality manual and does not forbid its use. I understand that your question is about an organization subcontracting design and development activities. An organization should evidence planning and control of subcontracted activities. You don’t have to detail your external service provider's design and development, you have to detail supplying or controlling design and development inputs, and at least control activities (at least verification and validation activities).
The following material will provide you information about quality manuals and design and development:
- Article – The future of the Quality Manual in ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/the-future-of-the-quality-manual-in-iso-90012015/ -manual-in-iso-90012015/
- How to control outsourced processes using ISO 9001 - https://advisera.com/9001academy/blog/2015/05/05/how-to-control-outsourced-processes-using-iso-9001/
- ISO 9001:2015 Internal Auditor Course - https://advisera.com/training/iso-9001-internal-auditor-course/
- Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Quality management system documentation structure
Can you give me an example for hierarchical level document of quality system?'
Answer
ISO 9001:2015 gives a lot of freedom in designing the quality management system documentation structure.
The following material will provide you information about a possible structure:
- Article – How to structure quality management system documentation - https://advisera.com/9001academy/knowledgebase/how-to-structure-quality-management-system-documentation/
- How to structure work instructions in the ISO 9001 QMS - https://advisera.com/9001academy/blog/2015/06/16/how-to-structure-work-instructions-in-the-iso-9001-qms/
- ISO 9001:2015 Documentation Toolkit - https://advisera.com/9001academy/iso-9001-documentation-toolkit/
- Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Performance data
Answer:
There is not such requirement of a minimum amount of peformance data in ISO 9001:2015. There are just some mandatory documents that are required by ISO 9001 in order to be compliant with the standard. In this article you can find those mandatory documents - List of mandatory documents required by ISO 9001:2015:
https://advisera.com/9001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-90012015/
To learn more about requirements of ISO 9001:2015, see these materials:
- Book – Discover ISO 9001:2015 through practical examples: https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/
- Free on-line training – ISO 9001:2015 Foundations: https://advisera.com/training/iso-9001-foundations-course/ -
Transfer of employee personal data to a third party
Answer:
Usually, for these kinds of processing activities companies rely on legitimate interest rather than consent. Basically what you need to do is to specify in your Employee Privacy Notice the fact that their personal data may be transferred to third party processors that perform payroll and accounting services.
If you want to find out more about privacy notices check out this webinar Privacy Notices under the EU GDPR (https://advisera.com/eugdpracademy/webinar/privacy-notices-under-the-eu-gdpr-free-webinar-on-demand/). -
ISO 14001 - non-mandatory clauses?
Answer:
No, there are no non-mandatory clauses in new version of ISO 14001.
The following material will provide you information about an environmental management system:
- ISO 14001 – 4 steps in identification and evaluation of environmental aspects - https://advisera.com/14001academy/knowledgebase/4-steps-in-identification-and-evaluation-of-environmental-aspects/
- List of ISO 14001 implementation steps - https://advisera.com/14001academy/blog/2019/08/27/key-iso-14001-benefits-to-customers/nowledgebase/list-of-iso-14001-implementation-steps/
- free online training ISO 14001:2015 Foundations Course - https://advisera.com/training/iso-14001-internal-auditor-course/
- book - THE ISO 14001:2015 COMPANION – A A Straightforward Guide to Implementing an EMS in a Small Business - https://advisera.com/books/the-iso-14001-2015-companion/ -
Developing checklists
Answer
Certification body auditors don’t have to ask awkward questions. Certification body auditors shouldn’t be fishing non-conformities at all cost.
The following material will provide you information about developing checklists and auditing:
- Article – ISO 9001 Audit Checklist - https://advisera.com/9001academy/knowledgebase/iso-9001-audit-checklist/
- ISO 9001 document template: Internal Audit Checklist - https://advisera.com/9001academy/documentation/internal-audit-checklist/
- [free course] ISO 9001:2015 Internal Auditor Course - https://advisera.com/training/iso-9001-internal-auditor-course/
- book - ISO Internal Audit: A Plain English Guide - https://advisera.com/books/iso-internal-audit-plain-english-guide/ -
Risk management process
1 - During the risk assessment, can we already take existing controls into consideration to assess the risk level ? and immediately assess the residual risk ?
Answer: In fact you must consider the existing controls when assessing risk, including the information about implemented controls in the last column. In this case the assessed risk will be already a residual risk, which can or can't be acceptable according your risk acceptance criteria.
2 - In the toolkit there is a risk treatment “table” and a risk assessment “plan”
What is the difference between both documents because in my assumption the “table” is already enough as a plan ?
Answer: The Appendix 2 Risk Treatment Table is the document used to select treatment options and controls.
The Risk Treatment Plan is the document where you list all the actions and resources needed to implement the treatment options identified in the Risk Treatment Table, as well as the respective deadlines an d responsible people.
As you can see, from the Risk treatment table to the risk treatment plan, the information becomes more focused on the risks that must be treated. You could have all this information in a single document, but this will make it more complex to handle.
By the way, included in the toolkit you bought you have access to video tutorials that will explain you about these documents and how to fill them in.
This article will provide you further explanation about risk treatment and risk treatment plan:
- Risk Treatment Plan and risk treatment process – What’s the difference? https://advisera.com/27001academy/iso-27001-risk-assessment-treatment-management/#treatment -
Documenting ISO 27001 and ISO 22301 documents
Answer:
ISO 22301 and ISO 27001 share many similar requirements that allow the use of a single document for both systems (e.g., document control procedure, internal audit etc.). Other required documents defined specifically for each standard, such as security policies and continuity strategy, can be kept separated without risks to create inconsistencies.
This article will provide you further explanation about integrating management systems:
- How to implement integrated management systems https://advisera.com/27001academy/blog/ 15/10/05/how-to-implement-integrated-management-systems/
This article will provide you further explanation about document management:
- Document management in ISO 27001 & BS 25999-2 https://advisera.com/27001academy/blog/2010/03/30/document-management-within-iso-27001-bs-25999-2/