EU GDPR applicability

1. Is the GDPR applicable only to companies or private persons as well?

The EU GDPR applies to the processing of personal data wholly or partly by automated means and to manual processing if the personal data form part of a filing system or are intended to form part of a filing system so you can see that there is no exclusion of private individuals. However, there are certain Supervisory Authorities ( e.g Romanian Supervisory Authority) that mentioned that GDPR only applies to companies.

2. Where do I need to publish my privacy policy?

It depends about the processing activities you want to describe. You can have a generic Privacy Policy covering the bulk of your processing activities but for very specific ones such as processing data you collect through your website or the data of your employees you need specific Policy/Notice.

3. Do I need to have an inventory of activities that I do?

Companies or institutions with fewer than 250 employees are exempt from keeping a record, if the processing is not likely to pose a risk to the rights and freedoms of the data subject, if no special categories of data are processed or if the processing is done only occasionally, as is indicated in Art. 30(5) GDPR. In practice, this exemption is rarely applicable.

4. Can I use GPS to monitor my sales agents?

You could use GPS but not to track your agents but rather the vehicles they are using. However you need let then know that this is happening via a Privacy Notice. You can find out more about Privacy Notices I from our free webinar “Privacy Notices under the EU GDPR” (https://advisera.com/eugdpracademy/webinar/privacy-notices-under-the-eu-gdpr-free-webinar-on-demand/).

5. Do I need the consent from my sales agents?

This depends on the jurisdiction where you are registered. You should check the Supervisory Authority website in if the country were you are registered. However, most EU countries do not require registration after the GDPR entered into force last year.