Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
GDPR legal basis for online card payments
Answer:
For card payment the legal basis for processing the “contract obligation” since there is a contract (although not a written one) between the individual initiating the payment and the company that facilitates the card payment. Also, the company facilitating the card payment may continue to process data based on “legal requirements” as well if such legal requirements exist.
To learn more about the EU GDPR check out our free “EU GDPR Foundations Course” https://advisera.com/training/eu-gdpr-foundations-course// -
Cookies
Cookies are regulated by the ePrivacy directive which requires you to inform the website visitors about the cookies which their website uses. There is a duty to inform not to get the consent, however the website owner needs to mention how can the browser be set not to accept cookies, so it works similar to a “opt out consent”.
If you choose to use consent to process the personal data collected via cookies you need to follow the requirements of consent meaning that it needs to be freely given, specific, informed and unambiguous indication of the individual’s wishes, so, opt out (pre-ticked boxes are not allowed).
To learn more about consent check out our free “EU GDPR Foundations Course” https://advisera.com/training/eu-gdpr-foundations-course// -
Data processing agreement
If your accountant is not your employee the answer would be yes. -
Information Transfer Procedure
I would like to know if you have any advice on best template to use in developing an Information Transfer Procedure.
Answer: The "Operating Procedures for Information and Communication Technology" template included in your toolkit already cover the guidance and recommendations from control A.13.2.1 (Information transfer policies and procedures), so you can use this template to implement information transfer procedures, or adapt the document to your needs.
This template can be found on folder 08 Annex A A.12 Operations security -
ISO 27018
Answer: ISO 27018 provides guidance and recommendations to protect personally identifiable information, so if your services involve your customers personal data, or personal data from their customers, then probably this standard is applicable to you. To determine that you should verify your customers requirements and the laws and regulations applicable to your business.
This article will provide you further explanation about ISO 27018:
- ISO 27001 vs. ISO 27018 – Standard for protecting privacy in the cloud https://advisera.com/27001academy/blog/2015/11/16/iso-27001-vs-iso-27018-standard-for-protecting-privacy-in-the-cloud/ -
Risk assessment and SoA
If I have a risk assessment documented already must I document the risks in the SOA as well?
Answer: The Statement of Applicability is required by ISO 27001 clause 6.1.3 d), so it is needed for certification purposes. In fact, it is one of the main documents used by the auditor during an audit.
Although important to the SoA to justify the applicability of controls, there is no need to document risks in the SoA. In such cases you can simply refer to the risks identifiers used on the risk assessment document (e.g., "control applicable to treat risks identified by numbers 12 and 34 in the risk assessment).
These article will provide you further explanation about mandatory documents and SoA:
- List of mandatory documents required by ISO 27001 (2013 revision) https://advisera.com/27001academy/knowledgebase/ dgebase/list-of-mandatory-documents-required-by-iso-27001-2013-revision/
- The importance of Statement of Applicability for ISO 27001 https://advisera.com/27001academy/knowledgebase/the-importance-of-statement-of-applicability-for-iso-27001/
These materials will also help you regarding mandatory documents and SoA:
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
Demostrar cumplimiento con ISO 22301
Respuesta: Cualquier compañía puede cumplir con ISO 22301, pero para esto, obviamente la compañía tiene que implementar el estándar, cumplimiento con sus requerimientos. Si yo soy un cliente de tu empresa, y quiero que me demuestres que puedes implementar el estándar, podrías mostrarme un plan de proyecto para la implementación del estándar, con la aprobación de la alta dirección.
Otra opción es la certificación de la ISO 22301 implementada, y otra opción es una auditoría de segunda parte.
Esta plantilla gratuita puede ayudarte a desarrollar el plan de proyecto “Project Plan for ISO 27001/ISO 22301 implementation” : https://info.advisera.com/27001academy/free-download/project-plan-for-iso-27001-iso-22301-implementation
Y este artículo puede ayudarte a conocer cómo implementar el estándar en tu organización “17 steps for implementing ISO 22301” : https://advisera.com/27001academy/knowledgebase/17-steps-for-implementing-iso-22301/22301/iso-22301/ -
Alta dirección
Respuesta: Si esta persona, formalmente, no es parte de la diracción, el problema puede ser que sus decisiones puedan ser ejecutadas informalmente, y esto puede ser un problema para el cumplimiento de la ISO 27001, porque tu organización podría no demostrar el liderazgo y compromiso de la alta dirección con respecto el sistema de gestión de seguridad de la información, lo cual es un importante requerimiento de la ISO 27001 (apartado 5.1.- Leadership and commitment). Por tanto, una recomendación sería que est a persona formalmente forme parte de la alta dirección.
Este artículo sobre roles y responsabilidades de la alta dirección puede ser interesante para ti “Roles and responsibilities of top management in ISO 27001 and ISO 22301” : https://advisera.com/27001academy/blog/2014/06/09/roles-and-responsibilities-of-top-management-in-iso-27001-and-iso-22301/
Y también este artículo sobre los beneficios de la implementación de la ISO 27001, que puede ser interesante para la dirección “Four key benefits of ISO 27001 implementation” : https://advisera.com/27001academy/knowledgebase/four-key-benefits-of-iso-27001-implementation/ -
Purpose of requesting the birth date
2. For the Data Subject Access Request Procedure. A Data Subject Access Request can be made verbally in Germany. Hence it is necessary to ensure that verbal requests are treated with the same level of care as with written requests.
Answers:
1. The birth date is mentioned for two purposes: for establishing that the individual is not a minor and as well as means of making you easy ti identify him/her in your systems. However, you may choose not to ask that information from the data subject.
2. I cant see any question related to the topic of “Data Subject Access Request Procedure”.
To learn more about DSARs check out our webinar “Data Subject Rights under the EU GDPR” https://advisera.com/eugdpracademy/webinar/data-subject-rights-under-the-eu-gdpr-free-webinar-on-demand/ -
Language of the Privacy policy
Answer:
If your website is targeting Italian users you can have the Privacy Notice/Notices in Italian only.
To learn more about privacy notices check out our webinar “Privacy Notices Under the EU GDPR” https://advisera.com/eugdpracademy/webinar/privacy-notices-under-the-eu-gdpr-free-webinar-on-demand/