Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Showing data on request of data controller
Article Art. 28(3) (h) of the EU GDPR states that the processor must inform the controller if, in its opinion, the controller’s instructions would breach Union or Member State law including the EU GDPR ( https://advisera.com/eugdpracademy/gdpr/processor/ ) so, if you have serious concerns it is your duty just to inform the controller.
It is the duty of the controllers to make sure that their instructions are lawful. Since you don’t have the full picture of the processing activity your perception about the processing being unlawful might be wrong. For example the controller could have already obtained the consent from the data subject thus you as a processor don’t need to obtain that again.
You don't need any extra conformation form the controller or the data subjects since is the job of the controller to ensure that any request that it might have is always in compliance with the EU GDPR and other data protection legislation.
For more information on the specific duties of controllers and processors I recommend to check out our article “EU GDPR controller vs. process or – What are the differences?” which can be found at : https://advisera.com/eugdpracademy/knowledgebase/eu-gdpr-controller-vs-processor-what-are-the-differences/ -
Processing personal data
Thanks for the answer. So if I'm correct we should focus on the software and can basically put a 'no' to all processing activities because we won't do them ourselves.
The only thing we need to make sure is that our software is GDPR compliant, regardless if the customer is using it that way. -
Does the toolkit include the 27002 documentation and best practices?
Answer: This is correct, ISO 27002 provides details on the implementation of 114 controls from ISO 27001 Annex A.
In our ISO 27001 toolkit we have 22 policies and procedures that cover Annex A controls, and all of these have taken the best practices from ISO 27002.
You have to keep in mind that ISO 27001 does not require each Annex A to be documented, therefore we didn't develop documentation for some controls like physical security - our main focus was on optimizing the number of documents for smaller companies, so that we avoid any overkill. See also this article: List of mandatory documents required by ISO 27001 (2013 revision) https://advisera.com/27001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-27001-2013-revision/
You can see the list of documents in the ISO 27001 Documentation Toolkit here: https://advisera.com/27001academy/iso-27001-documentation-toolkit/ - just scroll to section called "Toolkit documents". -
Importance of ISO certifications
ISO standards are becoming more and more popular, and especially ISO 27001 which explains how to manage information security. Here is an article that might help you: ISO 27001 Internal Auditor training – Is it good for my career? https://advisera.com/27001academy/blog/2016/03/29/iso-27001-internal-auditor-training-is-it-good-for-my-career/
However, there are also other security certificates you should consider - see this article CISA vs. ISO 27001 Lead Auditor certification https://advisera.com/27001academy/blog/2015/05/11/cisa-vs-iso-27001-lead-auditor-certification/
On our website you'll find a couple of online courses where you can get certified: https://advisera.com/training/ -
Documentation of processing activities
Answer:
As I understood from your query the company you are representing is mainly acting as a data processor on behalf of various controllers. This means that you should have contracts or other binding documents in place with the controllers with specific data protection clauses (or Data Processing A greements). Most of the information you need to fill in the Inventory of Processing Activities (the processor sheet) should be found in the documents mentioned above, documents that are signed by both controller and processor. Since you will use the information within these signed documents you don`t need any sign off from the controllers.
Also notice that EU GDPR article 30 requirements relate to the accountability obligation of controllers and processor as well and it is meant to abolish the need to notify data processing activities to a local supervisory authority (albeit not actually file those records with the supervisory authority) thus you need to prove that you comply with these obligations to the Supervisory Authorities and fail to comply would lead to your company being sanctioned and not the controller. This would make the sing off from the controllers useless both from your or your controllers point of view.
As on how to organize the Inventory of Processing Activities, this is up to you and the company you represent depending on the business you are running and the sheer number of controllers. I would suggest either having an inventory for each controller or, if you perform the exact processing activities for multiple controllers, you could have one inventory for such groups.
Article 30 (3) of the EU GDPR ( https://advisera.com/eugdpracademy/gdpr/records-of-processing-activities/) mentions that the inventory “shall be in writing, including in electronic form”, so both electronic or paper forms are allowed. We decided to go in our EU GDPR implementation toolkit https://advisera.com/eugdpracademy/eu-gdpr-documentation-toolkit/ with the .excel format since is a widely used format accessible to most companies. -
AS9100 Clause 8.1.3 - Product Safety
Answer given:
Per AS9100 Rev D you need to "plan, implement and control the processes needed to assure product safety..., as appropriate". So, if you are saying that you have assessed the hazards and risks associated by your product, and have no safety critical items to manage, then this should satisfy this requirement. These two items are the first examples in the note for this section, so really your method of satisfying the requirements of 8.1.3 are that you performed an assessment of the hazards and found none, so there are no associated risks to manage. -
Comparison of the different GDPR articles
Answer:
I would first suggest to check the websites of the Supervisory Authorities of the jurisdictions you are interested in. For Guernsey and Jersey you could try starting with https://www.gov.gg/article/158844/Data-Protection-EU-General-Data-Protection-Regulation.
The ICO in the UK has a pretty good website where you will find all the necessary information https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/ .
If you are interested in a document that contains local adaptations of the EU GDPR you could consult the “GDPR National Legislation Survey” issued by Baker and McKenzie which is publicly available here https://globalitc.bakermckenzie.com/files/Uploads/Documents/Global%20ITC/DSC146096_GDPR%20Survey%20National%20Legislation%20Updated%2026%20May%202017%20(Belfast).pdf.
DLA Piper has also on their website a s ection with local data protection laws around the world as well which can be consulted here: https://www.dlapiperdataprotection.com/index.html?t=eu-section&c=AU. -
Quality objectives
thank you strahinja -
EU GDPR procedures
Answer:
Articles 13 and 14 of the EU GDPR refer to the information to be provided to data subjects or “privacy notices”. You can find a “General Data Protection Notice” in folder 2 “Personal Data Policy Framework” which contains all the information you need to put into your “Privacy Notices”. Personal Data Records Management is covered by the “ Data Retention Policy” and “Data Retention Schedule” which can be found as well in ” in folder 2 “Personal Data Policy Framework”.
Folder 4 “Managing Data Subject Rights” contains the “Data Subject Access Request Procedure” that is meant to cover all the rights of the data subjects including the right to access, erase or rectify the data etc.
Please consider that you don’t actually need a “Data Minimization”, “Special Categories of Personal Data Procedure”, “Reference letters procedure” , “Direct Marketing procedure”, not every item from the EU GDPR needs a procedure or policy.
To get an overview of the whole content of the EU GDPR toolkit https://advisera.com/eugdpracademy/eu-gdpr-documentation-toolkit/ in terms of documents you should check out .pdf document called “List of Documents EU GDPR documentation toolkit”. -
Program success factors
The subject matter I need to know is how to keep a successful program running; why do people Pass successfully for several years, and then begin to fail (with disastrous consequences)?
The main reason for programs to start failing after a long period running is the loss of alignment between the program and the business objectives, so you should consider constant monitoring of business objectives and strategies, identification of how your programs can help support them, and implementation of proper adjustments.
I am a Certified Internal Auditor with several years of Internal Audit experience, getting ready to transition, and am looking for an ISO 27001 Analyst or Auditor job; how can I find companies who are (or are looking to become) ISO 27001 compliant?
For certified organizations you may try the websites of certification bodies (e.g, BSI, TUV, etc.). Some of them have databases with their certified organizations you can access. For organizations looking to become certified there is no such databases available, so you should rely on internet and professional social networks searches.