04.2 Personal Data Protection Policy Integrated

The Toolkit requires you to insert your national privacy law if any. Most countries, even EU Member States adopted internal laws and regulations to implement GDPR requirements in certain fields. Video surveillance, controls of workers, social security, criminal conviction, or health data are some examples of topics nationally implemented. 

You should consult the website of your local Data Protection Authority (or Surveillance Authority) to discover what are the applicable laws and regulations adopted in your country. Therefore, you should check if your organization is subjected to other extraterritorial privacy laws like the California Consumer Protection Act (CCPA) or the Brazilian Data Protection Act (LGPD). In such a case, you should also insert those references in your data protection policy.

Here you can find the list of relevant Data Protection Authorities and the list of laws and regulations on information security:

• Useful resources for complying with EU GDPR https://advisera.com/eugdpracademy/knowledgebase/useful-links/ 
• Laws and regulations on information security and business continuity https://advisera.com/27001academy/knowledgebase/laws-regulations-information-security-business-continuity/