Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Legitimate interest
Can you advise on that? If not, can you point us to an expert on marketing and legitimate interest?
Answer: Legitimate interest can be used for marketing but only under specific circumstances . If you intend to process personal data for the purposes of direct marketing by electronic means (by email, text, automated calls etc) legitimate interests may not always be an appropriate basis for processing. This is because the e-privacy laws on electronic marketing – currently the Privacy and Electronic Communications Regulations (PECR) – require that individuals give their consent to some forms of electronic marketing.
To learn more about marketing practices and the EU GDPR check out our webinar “How GDPR Affects Marketing Practices”. (https://advisera.com/eugdpracademy/webinar/how-gdpr-affects-marketing-practices-free-webinar-on-demand/). -
DPA in EU
1. In order to exchange personal data between a EU based company and a Japanese one acting as a separate controller you need to comply with the requirements for cross border data transfer. Most used of such safeguards is the use of Controller to Controller Standard Contractual Clauses.
To learn more about cross border data transfers check out our webinar “How to make personal data transfers to other countries compliant with GDPR” (https://advisera.com/webinars/how-to-make-personal-data-transfers-compliant-with-gdpr-free-webinar-on-demand/).
2. Notifying the Japanese Supervisory authority is subject to Japan`s local legal requirements in terms of data protection. The relation between you and the other controller needs to be established in the contract that you have with the European entity. -
Needed procedures
Answer:
ISO 9001:2015 has no mandatory procedures. Please check clause 4.4.2 a), if your organization believes that a Preventive Maintenance Procedure is needed then you should develop and maintain it, but it is up to you to decide.
The following material will provide you information about the procedure requirements:
- ISO 9001 – List of mandatory documents required by ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-90012015/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Keeping personal data of clients
Answer: This is true. The data cannot be kept for longer than is necessary for the purpose it was collected for. However, you can relay on consent and ask your customers if they agree that you keep their data for longer.
To learn more about the EU GDPR check out our “EU GDPR Foundations Course” (https://advisera.com/training/eu-gdpr-foundations-course//) -
Cómo abordar los riesgos en ISO 9001
Respuesta:
Para abordar de manera efectiva los riesgos de su organización, primero debe identificar correctamente los riesgos. Puede hacerlo utilizando un enfoque simple, es decir, organizando una sesión de lluvia de ideas con las personas relevantes de su organización y realizando un análisis pormenorizado. Una vez que se hayan identificado los riesgos, deberá planificar las acciones para abordar esos riesgos. Estas acciones deben ser proporcionales al impacto potencial de los riesgos en la conformidad del producto o servicio, y van desde evitar un riesgo a aceptar un riesgo. No existe un proceso formal para llevar a cabo este seguimiento y control de riesgos, el estándar solo requiere que las organizaciones identifiquen los riesgos y oportunidades y tomen acciones, y tampoco es necesario que usted lo documente.
Para obtener más información sobre los riesgos en ISO 9001: 2015, consulte estos artículos (en inglés):
- How to address risks and opportunities in ISO 9001: https://advisera.com /9001academy/blog/2016/06/21/how-to-address-risks-and-opportunities-in-iso-9001/
- Does ISO 9001 require a procedure for addressing risks and opportunities? -https://advisera.com/9001academy/blog/2017/10/10/does-iso-9001-require-a-procedure-for-addressing-risks-and-opportunities/
Además estos materiales pueden ayudarle con la implementación de ISO 9001:2015:
- Libro"Descubre ISO 9001:2015 mediante ejemplos prácticos" (en inglés): https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/
- Curso de Fundamentos ISO 9001:2015 : https://advisera.com/training/es/course/curso-fundamentos-iso-14001/
- Conformio - herramienta de cumplimiento en línea: https://advisera.com/conformio/ -
Auditor interno da ISO 9001
Resposta:
Você não precisa ter um certificado de auditoria interna para se tornar um auditor interno, apenas experiência em ISO 9001 e auditoria. Não há requisitos obrigatórios na ISO 9001 para se tornar um auditor interno, mas certas habilidades, competências e qualificações podem ajudar uma pessoa a trabalhar como auditor interno. Uma combinação de conhecimento do processo interno da ISO 9001: 2015 e atenção aos detalhes permanecem os principais atributos.
Estes materiais podem ajudá-lo a aprender mais sobre auditorias internas:
- Curso de auditor interno da ISO 9001: 20 15: https://advisera.com/training/iso-9001-internal-auditor-course/
- Livro - auditoria interna ISO - um guia simples: https://advisera.com/books/iso-internal-audit-plain-english-guide/ -
Information security behaviour evaluation
Answer: ISO 27001 is perhaps not the best framework to examine the behaviour of employees, however you can use the following clauses as a guideline:
- clause 7.3 (awareness): this clause requires the organization to ensure employees to be aware of the information security policy, their contribution to the the protection of the information a nd performance of the Information Security Management System, and the consequences of information security incidents.
- clause 9.1 requires the organization to monitor, measure, analyse and evaluate security controls and process, including controls directly related to human resources, such as A.7.2.2 (Information security awareness, education and training) and A.8.1.3 (Acceptable use of assets)
By assessing these requirements you can have an overview of the employees information security behaviour (e.g., by the results of an information security policy understanding survey, number of non conformities or security incidents related to employees, etc.).
2 - And the other question is, if this is feasible, is there a check list for this job?
Answer: For this evaluation, I suggest you to take a look at our ISO 27001 Gap Analysis Tool at this link: https://advisera.com/27001academy/free-iso-27001-gap-analysis-tool/
This checklist has questions that can help you assess if standard's requirements are being fulfilled.
These articles will provide you further explanation about ISO 27001 awareness:
- How to perform training & awareness for ISO 27001 and ISO 22301 https://advisera.com/27001academy/blog/2014/05/19/how-to-perform-training-awareness-for-iso-27001-and-iso-22301/
- 8 Security Practices to Use in Your Employee Training and Awareness Program https://advisera.com/27001academy/blog/2015/03/02/8-security-practices-to-use-in-your-employee-training-and-awareness-program/
These materials will also help you regarding ISO 27001 awareness:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
Supplier development
Answer:
The primary purpose of the supplier development is to ensure that the supplier is capable to provide product or services required and in volume and quality that the organization requires. This means that the organization needs to get the proper information on the processes of the supplier and the capability of the processes and determine what is the best way to influence the suppliers and develop them and ensure that they will deliver what is required.
The main sources of information on the supplier performance are:
- supplier monitoring
- second-party audits
- third-party certification audit results
- risk analysis
Once you get the proper information on the supplier performance, you can decide whatever to organize training for the supplier, or to require changes in the processes or equipment being used in the product or service delivery. -
Green training importance
Answer:
What is the actual and potential significative environmental impacts of your organization? The more significative the environmental impacts the more irrelevant is green training. People should know what the actual and potential environmental impacts of what they do are. Related with that is the competence evaluation, the more competent in environmental matters people are, the less relevant is green training. Also consider the level of staff turnover, the higher the more important is green training. Remember training per se is not mandatory with ISO 14001. Training is one of the possible answers to a lack of competency sityation.
The following material will provide you information about green training:
- ISO 14001 – ISO 14001 Competence, Training & Awareness: Why are they important for your EMS? - https://advisera.com/14001academy/blog/2014/11/26/iso-14001-competence-training-awareness-important-ems/
- Do you have to train your whole workforce on the ISO 14001 standard? - https://advisera.com/14001academy/blog/2016/01/25/do-you-have-to-train-your-whole-workforce-on-the-iso-14001-standard/
- free online training ISO 14001:2015 Foundations Course - https://advisera.com/training/iso-14001-internal-auditor-course/
- book - THE ISO 14001:2015 COMPANION – A A Straightforward Guide to Implementing an EMS in a Small Business - https://advisera.com/books/the-iso-14001-2015-companion/ -
Rework is not mandatory
Answer:
Rework is not mandatory. Rework is just one of the possible alternatives to handle a product nonconformity? Sometimes one can rework, sometimes one can sell as a downgraded version, sometimes one can only scrap.
The following material will provide you information about the product nonconformities:
- ISO 9001 – Understanding dispositions for ISO 9001 nonconforming product - https://advisera.com/9001academy/blog/2014/11/18/understanding-dispositions-iso-9001-nonconforming-product/
- Five Steps for ISO 9001 Nonconforming Products - https://advisera.com/9001academy/blog/2014/01/13/five-steps-iso-9001-nonconforming-products/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/