Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Documentation examples
Answer: Included in the toolkit you bought you have access to video tutorials explaining how to fill in some templates with real data (e.g., document control procedure, internal audit procedure, procedure for corrective action, risk assessment, risk treatment plan, etc.). -
DPIA Register template
2. Can 06.2 & 06.3 templates be used as it is to be available for use when needed? Is it necessary to allocate to it a Confidentiality Level?
Answers:
1. You can edit the DPIA Register to better suit your specific business needs especially in terms of the questions which not marked as mandatory.
2. The templates themselves are not confidential since they are drafted by the EU Commission. However, when filling them in with all the details you can apply to them the same confidentiality level as the commercial contract which they refer to.
To learn more about the EU GDPR check out our free “EU GDPR Foundations Course” https://advisera.com/training/eu-gdpr-foundations-course// -
Data subject access request procedure
Is this definitely right, where is the reference in GDPR legislation ?
Answer:
The EU GDPR is considered in legal terms as “lex generalis” which means that it can be overridden by specific legal obligations such as the ones referring to copyright as well as attorney – customer communication.
There is no specific text in the GDPR but it is a well known fact. -
Internal audits scope
Answer:
Internal audits are required on all QMS processes and all ISO 9001 clauses, even an internal audit including in its scope the internal audits.
The following material will provide you information about the internal audits:
- ISO 9001 – ISO 9001 – How to prepare for an internal audit - https://advisera.com/9001academy/blog/2017/09/26/iso-9001-how-to-prepare-for-an-internal-audit/
- Five Main Steps in ISO 9001 Internal Audit https://advisera.com/9001academy/knowledgebase/five-main-steps-in-iso-9001-internal-audit/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book - ISO Internal Audit: A Plain English Guide - https://advisera.com/books/iso-internal-audit-plain-english-guide/ -
Opt-in checkboxes
Answer:
I would advise you to have separate checkboxes for the channels which you use to communicate with the customer.
To find out more about consent check out our webinar “How to handle consents under GDPR” https://advisera.com/eugdpracademy/webinar/how-to-handle-consents-under-gdpr-free-webinar-on-demand/ -
Contracts with sites within EU
Answer:
If you have ongoing contracts with the individuals then the lawful grounds for processing would be “contractual obligation” rather than consent. So, you would only need to provide them with the relevant information via your privacy notice/notices.
To learn more about privacy notices check out our webinar “Privacy notices under he EU GDPR” https://advisera.com/eugdpracademy/webinar/privacy-notices-under-the-eu-gdpr-free-webinar-on-demand/ -
Subject access request
Answer:
Checking the identity of the data subject is one of the first steps when dealing with a DSAR so waiting till the last day to confirm the identity of the requester to get the 30 days period “reset” would most likely be considered abusive. So my advice is to check the identity of the requester as soon as possible in he process. Please consult the “Data Subject Access Request Flowchart” which is part of the “ DATA SUBJECT ACCESS REQUEST PROCEDURE” to see how a DSAR flow could look like.
As regards to the form is not a compulsory requirement to use a specific template although is advisable to do so as the requests would be handled much easier and in a consistent way.
To learn more about DSARs check out our webinar “Data Subject Rights under the EU GDPR” (https://advisera.com/eugdpracademy/webinar/data-subject-rights-under-the-eu-gdpr-free-webinar-on-demand/). -
VAT number
If you have just one website which collects data from users you should list both controller entities with their registered address so the users can know who are the data controllers. Is not absolutely necessary to mention the VAT number the contact details should be enough. -
Outsourced activities in ISO 9001
ISO 9001:2015 requires that external providers must be controlled and their performance be evaluated by your organization (since it is your organization which hires their services) but they won´t be audited by the certification body.
Regarding the extent of the controls for external providers established by your company, they must be determined by your organization, sometimes a contract which states your requirements should be enough, but in other occasions you will need to provide the external providers with documented procedures or instructions with your QMS criteria and even carry out some inspections.
To learn more about outsourced processes you can see these articles:
- How to control outsourced processes using ISO 9001: https://advisera.com/9001academy/blog/2015/05/05/how-to-control-outsourced-processes-using-iso-9001/
- How to evaluate supplier performance according to ISO 9001:2015: https://advisera.com/9001academy/blog/2015/10/27/how-to-evaluate-supplier-performance-according-to-iso-90012015/
These materials can also help you with the implementation of ISO 9001:2015:
- Book "Discover ISO 9001:2015 through practical examples": https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/
- ISO 9001:2015 Foundations Course: https://advisera.com/training/iso-9001-foundations-course/
- Conformio - Compliance tool: https://advisera.com/conformio/ -
server
No it is not. You can store data outside the EU as long as you have implemented the appropriate safeguards as per EU GDPR Chapter 5 – “Transfers of personal data to third countries or international organisations” https://advisera.com/eugdpracademy/gdpr-text/transfers-of-personal-data-to-third-countries-or-international-organisations/ such as Standard contractual clauses.
To learn more about data transfers check out our webinar “How to make personal data transfers to other countries compliant with GDPR” https://advisera.com/webinars/how-to-make-personal-data-transfers-compliant-with-gdpr-free-webinar-on-demand/