Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
What is needed to prepare certification audit
Answer:
When you wrote “Already we had ISO 9001:2008” do you mean your college is certified according to ISO 9001:2008? If the answer is yes, my advice is to contact your Certification Body and ask this question. If the answer is no, your college will have to contact several certification bodies and request proposals, at the same time you can ask this question.
Normally, certification bodies ask for number of employees, working schedules, number of locations, certification scope and request a quality manual or any set of documents that describe the quality policy, the process map, quality objectives and relevant docu ments.
The following material will provide you information about the certification process:
- ISO 9001 – How do you prove to the certification auditor that QMS processes are carried out as planned? - https://advisera.com/9001academy/blog/2016/12/13/how-do-you-prove-to-the-certification-auditor-that-qms-processes-are-carried-out-as-planned/
- How should you pick an ISO 9001 certification body? - https://advisera.com/blog/2021/01/11/how-to-choose-an-iso-certification-body/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Privacy policy of the website owner
My scenario is the following: Clients of the web give their data to the owner of the web -I do the maintenance and the total management of the server where the web is (therefore I could have access to the data of the clients of the owner of the web) -I rent servers to a hosting company (this could access the data of those customers too).
Answer:
Form your description it looks like you are acting as a data processor on behalf of the website owner which is the data controller. This means that the date controller would need to mention in its website Privacy Notice that personal data of the visitor may be transferred to third parties (is not necessary to mention by name which are those third parties) .
To learn more about privacy notices check out or webinar “Privacy Notices Under the EU GDPR” (https://advisera.com/eugdpracademy/webinar/privacy-notices-under-the-eu-gdpr-free-webinar-on-demand/) -
Project implementation report
Answer:
There is no specific template for a project implementation report this is something that depends on the way that a company decides to proceed with the implementation. In a nutshell this report should be presented to the management as proof that the project is either ongoing or it has come to an end providing as well some details of the measures that were taken as well as responsible.
As for the date I would advise against backdating any documents this may be considered as an offence in some countries.
To learn more about the EU GDPR check out our “EU GDPR Foundation Course” (https://advisera.com/training/eu-gdpr-foundations-course//). -
GDPR Compliance
Answer:
Based on your description you are acting as a data processor and you may be processing personal data on behalf of controllers in the EU. You should be acting upon the instructions of the controllers so my suggestion is to ensure that you can comply with the instructions provided by controllers which are established in the EU.
To learn more about the EU GDPR check out our “EU GDPR Foundation Course” (https://advisera.com/training/eu-gdpr-foundations-course//). -
Toolkit templates
1. Business Continuity Plan with Roles and Responsibility of BCP manager.
2. Software Change Management policy and process { including Change Advisory Body (CAB) management process}
3. Suppler Performance Evaluation process and Evaluation form
It will be highly appreciated if you kindly provide me template.
Answer: Just to note that to be complaint with ISO 27001 requirements the Business Continuity Plan, Software Change Management process and the Supplier Performance Evaluation process and Evaluation form are not mandatory, however if you decide to write those documents, they are already included in your toolkit:
- to cover all ISO 27001 requirements for business continuity you can use the Disaster Recovery Plan, located on folder 08 Annex A A.17 Business Continuity
- to cover the Software Change Management policy, you can use as template the Change Management policy, located in folder 08 Annex A A.12 Operations security.
- to c over the evaluation process you can use the Supplier Security Policy, located on folder 08 Annex A A.15 Supplier relationships
If you need them for other reasons (e.g., to comply with a legal requirement), I suggest you to schedule a meeting with one of our experts so he can guide you through this elaboration process. To schedule a meeting , please access this link: https://advisera.com/27001academy/consultation/ -
Questions from the external auditor
Answer:
The external auditor will ask questions in order to be able to conclude about the conformance and/or effectiveness of the management system. When auditing quality personnel he will be making questions like:
Is the quality control plan at reception and production being fulfilled? Evidence!
Are nonconformities identified, segregated and treated? Evidence!
Are corrective actions developed and effective? Evidence!
Is process and product performance monitored, and decisions made? Evidence!
The following material will provide you information about the certification audit:
- ISO 9001 – How to deal with nonconformities in an ISO 9001 certification audit - https://advisera.com/9001academy/blog/2015/06/09/how-to-deal-with-nonconformities-in-an-iso-9001-certification-audit/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book – Preparing for ISO Certific ation Audit: A Plain English Guide - https://advisera.com/books/preparing-for-iso-certification-audit-plain-english-guide/ -
Right to be deleted
Facebook and Google track their usage of our site. We may continue showing them remarketing ads theoretically for months to come, by using Google and Facebook tools. I believe Facebook and Google are the data controller.
Do we have an obligation to not do this? It's very hard to comply with this technically, and I'm not sure we are required to?
Answer:
If it is Facebook or Goggle that this means that they are the controllers and your customer should direct their deletion request as well. As long as you delete the data and inform the user of the website that Facebook and Google are using cookies to track the behavior o the user of the websites though your cookie policy (providing information on how to set up the website not to accept cookies) you should be fine.
To learn more about data subject rights check out our webinar “Data Subject Rights und er the EU GPPR” https://advisera.com/eugdpracademy/webinar/data-subject-rights-under-the-eu-gdpr-free-webinar-on-demand/ -
Obligations to EU residents
2. Do our clients need to obtain permission to input this personal information first?
3. Do we need to purge any historical data about EU residents from our database if we do not know how the information was collected?
Answers:
1. From the beginning it is important to know that GDPR is applicable to your company because you are monitoring individuals who’s behavior takes place within the European Union. As your company is collecting the data and decides what data is to be collected this makes it a controller. It should notify the EU residents from it’s data base that is processing their personal data as per the requirements of EU GDPR article 14 - “Information to be provided where personal data have not been obtained from the data subject” (https://advisera.com/eugdpracademy/gdpr/information-to-be-provided-where-personal-data-have-not-been-obtained-from-the-data-subject/)
2. Your client acts as a controller as well and should notif y the EU Residents that he is processing their personal data and also to communicate them the source of the data (which in this case is you). See art. 14 from the EU GDPR – “Information to be provided where personal data have not been obtained from the data subject” (https://advisera.com/eugdpracademy/gdpr/information-to-be-provided-where-personal-data-have-not-been-obtained-from-the-data-subject/ )
3. According to GDPR you can not process personal data unless you have a legal ground. If you can not rely on a legal ground than your processing activity may be unlawful. In conclusion, if you can not prove that your personal data was collected legally, than you should erase it.
To learn more about the EU GDPR check out our free “EU GDPR Foundations Course” https://advisera.com/training/eu-gdpr-foundations-course// -
Parent's right
Answer:
This is related to the age of the student and the local legislation. As long as the parent acts as the legal guardian of the student then the parent is entitled to ask for that information. -
Non- EU clients
2. Eventually, we should protect all the data for the EU clients/ Non-EU clients who has business contact in Europe, right?
Answers:
1. If I understand correctly, after the process of incorporation the company will have the headquarter or a subsidiary in European Union. In this case the answer is yes, GDPR applies to every company which is based in European Union and processes personal data. For example, a company based in the EU which is processing the data of Japanese individuals located in Japan will still need to comply with the EU GDPR.
2. Yes you should protect the personal data of every individual who’s data you are collecting as long as your business is based in European Union.
To learn more about the EU GDPR check out our free “EU GDPR Foundations Course” https://advisera.com/training/eu-gdpr-foundations-course//