Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Standards applicability
Answer: ISO management standards (like ISO 27001 / BS EN ISO 9001) were designed to be implemented in organizations of any industry or size, so they would work the same way for any of them:
1 - Identification of business context and requirements
2 - Development and implementation of documents and records required by the standard
3 - Development and implementation of documents and records required by business operations
4 - Processes performance measurement, monitoring and review
5 - Implementation of corrective actions and opportunities of improvement
The difference would be in the number and complexity of the developed documentation, and the required resources.
These articles will provide you further explanation about ISO 27001:
- What is IS 27001 https://advisera.com/27001academy/what-is-iso-27001/
- ISO 27001 implementation checklist https://advisera.com/27001academy/knowledgebase/iso-27001-implementation-checklist/
2 - Can this apply and is it useful/necessary in this case or is there any equivalent?
Answer: As mentioned in answer 1, these standards can be applied in your case, and can be useful in at least four ways:
- to decrease costs related to information security incidents
- to provide a competitive edge in your market
- to help organize operations
- to help ensure compliance with legal requirements you must fulfil
Regarding necessity, you should consider your customers and legal requirements you must comply with.
This article will provide you further explanation about ISO 27001 benefits:
- Four key benefits of ISO 27001 implementation https://advisera.com/27001academy/knowledgebase/four-key-benefits-of-iso-27001-implementation/
3 - Also what is the average cost for an "extra" small company ( Web-based Dev - 1 employee )
Answer: There are a significant number of variables to be considered when estimating an implementation cost, even for such a small organizations, so without more detailed information it's not possible to precise a value. What I can tell you are some cost issues you should consider:
- Training and literature
- External assistance
- Technologies to be updated / implemented
- Employee's effort and time
- The certification process
Regarding knowledge on costs, I suggest you these articles:
- How much does ISO 27001 implementation cost? https://advisera.com/27001academy/blog/2011/02/08/how-much-does-iso-27001-implementation-cost/
- 5 ways to avoid overhead with ISO 27001 (and keep the costs down) https://advisera.com/27001academy/blog/2012/06/19/5-ways-to-avoid-overhead-with-iso-27001-and-keep-the-costs-down/
- How to Budget an ISO 27001 Implementation Project https://info.advisera.com/27001academy/free-download/how-to-budget-an-iso-27001-implementation-project -
Audit results
I believe somewhere in your information you recommend against sharing audit results with the customer. If this is true, could you send me a link to that information? It will help to convince Sales that this is not a good idea.
Answer: The sharing of audit results with customers should be handled carefully. While this can be a good marketing tool to demonstrate good faith and commitment of your organization with customers, it also may reveal situations that can compromise the relationship and your organization image if not handled properly.
My advice would be for your organization to define, by means of contracts and service agreements, in which situations these results should be shared, what information would be sha red, and what measures should be taken by the customer to protect this information (e.g., those customers that will have the access to the results should sign a non disclosure agreement). -
Comprehensive consent document
Answer:
According to the EU GDPR consent needs to be “freely given, specific, informed and unambiguous indication of the individual’s wishes.” Among other thigs this means that if the relevant processing has multiple purposes, consent must be given for all of them and since we cannot possibly all the instances someone would ask for consent is up to the controller (you) to identify those purposes.
Also you cannot use the so called “bundled consent”. Where different processing activities are taking place, consent is presumed not valid unless the individual can consent to them separately.
Having this in mind is impossible to have a readily available consent form to cover all scenarios.
To learn more about consent pleas check out our article “Is consent needed? Six legal bases to process data according to GDPR” https://advisera.com/eugdpracademy/knowledgebase/is-consent-needed-six-legal-bases-to-process-data-according-to-gdpr/ -
Supervisory Authority
Could you explain in detail how we can contact to the Supervisory Authority:
1. Where I can find contacts like email, address, phone number etc. for Supervisory Authority
2. Should we contact to the Supervisory Authority in a specific country? What does it depend on?
Answers:
1. Here is a link to a EU commission's page containing the contact details of Supervisory Authorities in EU countries - https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080
To learn more about data breaches check out our article “5 steps to handle a data breach according to GDPR” https://advisera.com/eugdpracademy/knowledgebase/5-steps-to-handle-a-data-breach-according-to-gdpr/ -
Internal record of processing
Answer:
The “Inventory of Processing Activities” is mandatory if (a) the company has more than 250 employees; or (b) the processing the company carries out is likely to result in a risk to the rights and freedoms of data subjects; or (c) the processing is not occasional; or (d) the processing includes special categories of data (personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation);or (e) the processing includes personal data relating to criminal convictions and offences.
To learn more about the EU GDPR check out our free “EU GDPR Foundations Course” https://advisera.com/training/eu-gdpr-foundations-course// -
Quality tools in ITSM
Answer:
Tools used for quality control have similarities in how we (in ITSM) control quality of delivered services.
Some of the tools that are used to control quality in development and delivery of IT services are:
Testing - to ensure that user's requirements and (quality) expectations are met
Fishbone (or Ishikava) diagram . in e.g. problem resolution
Trend analysis - reporting and trend monitoring is one of the ISO 20000 requirements
Histograms - used to have clear picture of services delivered over longer period of time
Cause and effect analysis - in incident, problem or change management
To read more about Quality Management (applicable to IT service delivery), read the article How to use quality control tools to improve your QMS https://advisera.com/9001academy/blog/2017/04/18/how-to-use-quality-control-tools-to-improve-your-qms/ -
GDPR - specific protections for children
Answer:
The EU GDPR contains specific protections for children. You can only get consent from a child in relation to online services if it is authorized by a parent. A child is someone below the age of 16, though Member States can reduce this age to 13.
The EU GDPR does not apply this restriction when obtaining consent from a child offline, but given the tight controls on consent, you may still wish to obtain parental authorization.
You can find draft parental consent form in our EU GDPR Documentation Toolkit here : https://advisera.com/eugdpracademy/eu-gdpr-documentation-toolkit/
To learn more about t he EU GDPR check out our free “EU GDPR Foundations Course” https://advisera.com/training/eu-gdpr-foundations-course// -
Data subject access requests
Answer:
Yes you are right, data subject access requests are to be handled by the controllers which may ask their respective processors for information in order to be able to accurately respond to such a request.
To learn more about data subject rights check out our webinar “Data Subject Rights under the EU GDPR” https://advisera.com/eugdpracademy/webinar/data-subject-rights-under-the-eu-gdpr-free-webinar-on-demand/ -
Legitimate interest for marketing emails
Answer:
The EU GDPR does not say that direct marketing always constitutes a legitimate interest, and whether your processing is lawful on the basis of legitimate interests depends on the particular circumstances.
In terms of the purpose test, some forms of marketing may not be legitimate if they do not comply with other legal or ethical standards or with industry codes of practice. However, as long as the marketing is carried out in compliance with e-privacy laws and other legal and industry standards, in most cases it is likely that direct marketing is a legitimate interest.
If you intend to process personal data for the purposes of direct marketing by electronic means (by email, text, automated calls etc) legitimate interests may not always be an appropriate basis for processing. This is because the e-priva cy laws on electronic marketing – currently the Privacy and Electronic Communications Regulations (PECR) – require that individuals give their consent to some forms of electronic marketing.
So, I would advise you at least for direct marketing to have a cautious approach and go with consent rather legitimate interest
To learn more about consent check out our webinar “How to handle consents under GDPR” https://advisera.com/eugdpracademy/webinar/how-to-handle-consents-under-gdpr-free-webinar-on-demand/ -
Employee Privacy Notice
2. Do we need to state the legal entity of each country i.e. one version for each country?
3. Any example for “legal or business” purpose as mentioned in the template?
4. Do we need any consent (via the Data Subject Consent Form) from our employee when we use their photos on the corporate web site? We know consent is not needed for any personal data submitted for employment purpose but since the web site is generally used as a marketing tool, I would like to confirm the need of employee’s consent.
Answers:
1. The privacy notice could be sent by email to all employees and also placed on the intranet page of the company. Is not necessary to get the acknowledgment but only to make available the notice to the employees.
2. You need to have an Employee Privacy Notice for each country if you have separate entities there. The content however could be similar if the HR processing activities are similar.
3. I don`t understand this question can you please rephrase it. Usually for HR the legal basis are contract obligations and legitimate interest.
4. Publishing an employee photo on the corporate website is not part of executing the labor agreement so their consent would be needed.