GDPR COMPLIANCE

TERMINOLOGIES

Listed are certain terms that you will come across in the following description, so it is correlated as shown below:

• 1.DATA SUBJECT: Customer or User.
• 2.PERSONAL DATA: The data related to the user.
• 3.DATA PROCESSING: Operation performed on the user’s personal data, whether automated or manually.
• 4.PROFILING: Processing of personal data for analysing or predicting the user’s behaviour or preferences.
• 5.DATA CONTROLLER: A person within the organization that determines the purpose, condition and means for processing of user’s personal data.
• 6.PROCESSOR: An entity that processes the data on behest of the data controller.
• 7.SUPERVISORY AUTHORITY: The public authority established by the member state, like UK’s Information Commissioner Office (IFO).
• 8.DATA PROTECTION OFFICER: A person within the organization who ensures that the norms of GDPR are followed at each level of handling user’s data.

PRINCIPLES OF GDPR

• 1.The data that is collected should be used for specific and explicit purpose(s) only i.e. the reason for which the data has been captured.
• 2.The data that is captured should be accurate and maintained.
• 3.How long the data is to be retained, is needed to be specified.
• 4.Data must be processed lawfully, transparently and fairly.
• 5.Data must be processed securely and must be able to prove it.
• 6.Data that is held must be adequate, relevant and limited to what is needed.

PENALTIES

• 1.LOWER LEVEL INFRINGMENTS: 10 million Euros or 2% of the worldwide annual revenue.
• 2.HIGHER LEVEL INFRINGEMENTS: 20 million Euros or 4% of the worldwide annual revenue.
• 3.Organization is accountable and can be penalized for breaches.

DATA SUBJECT RIGHTS (USER RIGHTS)

• 1.Data Portability
• 2.Data Rectification
• 3.Data Erasure
• 4.Profiling and Fairness
• 5.Data Access
• 6.Restricting the processing of data
• 7.Objecting to processing of data
• 8.Information Privacy

DATA PROTECTION OFFICER (DPO)

NEED FOR DPO:

• 1.For processing carried by Public Authority.
• 2.Monitoring of large scale of data.
• 3.Large scale processing of special category of personal data.

Circumstances where there isn’t any need for DPO:

• 1.There is no processing of special category of Personal Information.
• 2.Small group of data subjects.
• 3.No need for data monitoring.

ROLE OF DPO:

• 1.Assisting the Data Controller and Data Processor, to comply with the data protection law and avoid risks in processing the data.
• 2.SPOC for handling all sorts of data protection queries.
• 3.Monitoring of the GDPR compliance.
• 4.Inform and advise on the data protection aspects.
• 5.Determine the impact of the Data Protection Impact Assessment (DPIA).
• 6.Promoting the culture of data protection within the organization
• 7.Thoroughly understanding data processing and data security.
• 8.Submit the DPO reports to the senior/top management.
• 9.The Data Processing Officer is supposed to ensure that all the given principles of GDPR are adhered to.

PRIVACY AND TRANSPARENCY

• 1.Transparency in accessing and fairness in holding personal data.
• 2.Privacy Notes and T&C to make it clear and easy for the customer to understand. It should be non-ambiguous.
• 3.The details of the Data Controller and contact information should be precisely specified.
• 4.Similarly, the DPO’s details and contact information should be precisely specified.
• 5.The data processing activities should be done legally.
• 6.Legitimate interest of the Data Controller.
• 7.The data that is either held or processed should be categorized. Also, it needs to be specified, who exactly will get that data and why?
• 8.Safeguarding of the data that is either held or transferred to another country.
• 9.Time duration for retaining the data i.e. the time required for retaining must be mentioned and should be justified if questioned.
• 10.Data Subject (user) can withdraw consent and it should be easily done the way as it was done while giving consent.
• 11.The user should be notified on how and whom to approach, if they want to raise their concerns, queries or grievances.
• 12.The legal and contractual obligations should be disclosed, in order to provide the data.
• 13.Similarly, the legal and contractual obligations for not providing the data should also be disclosed.

DATA HOLDING/STORING

• 1.What data has been captured, stored and processed and the reason for each of these activities.
• 2.The purpose for holding the data must be documented.
• 3.Moreover, the source from where the data has come should also be documented.
• 4.DPO should provide a template for recording the information.
• 5.Recording the data, if it is required to be given to any third party for processing.
• 6.The data lifecycle should be present, which shows the source of data, how it comes into system, moves through the system and finally exits from the system.
• 7.Should be able to prove the compliance to the 6 principles of GDPR.

CHECKLIST 1:

• 1.When and from where has the information been obtained?
• 2.The purpose for using the information.
• 3.Is the captured information whole or is it partial?
• 4.Has the user given explicit permission (consent) to hold and process the data for the purpose that it was captured for in the first place.

CHECKLIST 2:

• 1.Is the data securely held?
• 2.Has the data been passed on to others? i.e. either within or outside the organization.
• 3.Are there legitimate rights to pass that information on to others?
• 4.Is the action justified in relation to the processing of the data?
• 5.Are all the principles and compliances of GDPR met?

PROCESSING DATA LAWFULLY

• 1.CONSENT: The Data Subject (user) must have given consent for data to be captured and used for specific purpose. Provision of consent should be as simple as withdrawing the same.
• 2.PROCESSING: Processing is required when there is an actual need to do so.
• 3.LEGAL OBLIGATION: This may be required to process data meant for a legal reason.
• 4.IN PUBLIC INTEREST: This may be required for collecting data for public service planning.
• 5.DOCUMENTATION: All the evidences must be documented.

SUBJECT DATA ACCESS REQUESTS (SAR)

• 1.RIGHT TO ACCESS: An user should have the rights to obtain confirmation for processing their data, access to their data and other supplementary information.
• 2.DOES THE PROVISSION FOR SUBJECT ACCESS REQUEST ATTRACT A FEE: If yes, it is necessary to provide information free of cost. Reasonable fees to be charged for repeated requests. But, this does not mean that the charges are to be applied for all subsequent access requirements.
• 3.TIMLELINE FOR THE SAR: Information must be provided without delay and within one month of receiving the request. The time could be extended, if the request is complex or multiple. The extension of time should be informed to the user within one month of receiving the request along with the reason for the extension.
• 4.PROVIDING INFORMATION: To check the identity of the person, who has made the request. The information, if possible, could be provided remotely too, by providing access to a self-service system, but without compromising on the security, rights and freedom of the other users.

RECTIFICATION AND ERASURE OF DATA

• 1.Individuals are entitled to have their personal information rectified if it is found to be inaccurate or incomplete.
• 2.The user’s request for rectification must be responded within one month of reception.
• 3.This could be extended to two months in case of complex rectification.
• 4.If no action is taken by the company, then the user has the rights to approach the higher supervisory authority.
• 5.The ‘Right to Erasure’, also known as ‘Right to be Forgotten’.
• 6.Also, once the user withdraws the consent, the data should be erased immediately.
• 7.The data elimination could also take place owing to a user objecting to the data procession.
• 8.The data elimination can also happen if the data is unlawfully processed, or due to non-compliance with the legal obligation.

RESTRICTING DATA USE

• 1.When the data processing is restricted, the company still has the authority to hold the data but cannot process it.
• 2.If the company has third-party ties, then the company is responsible to inform the third parties, about the restriction in processing the data.
• 3.In all circumstances, it is necessary for the company to keep the customer informed on the restriction that has either been introduced or revoked.

RIGHT TO OBJECT

• 1.The user has the right to object, and this must be informed to them in the initial communication and the same must be mentioned in the privacy notice too.
• 2.This must be explicitly brought to the attention of the user and should be presented clearly and separately from the other set of information.
• 3.The user has the right to object the processing based on the legitimate interest or in favour of public interest.
• 4.The user also has the right for direct marketing, scientific purpose, historical researches and statistics.

DATA PROFILING

• 1.Profiling is the procession of personal data to evaluate personal aspect about an individual’s performance at work, economic situation, health, personal preferences, interest, behaviour, location and movement.
• 2.It is the right of a user, to not to be subjected to a decision, especially when it is an automated processing, or if it leads to a legal or significant ramification for an individual.

DATA PORTABILITY

• 1.The right to data portability allows an individual to get and reuse their personal data for their purposes across different services.
• 2.This could be done by moving, copying, or transferring personal data from one IT environment to another without any hindrances in a secure manner.
• 3.Once the user makes a request for the same, it is necessary to transmit the data from the existing organization to the other organization; with the prerequisite that it is technically possible.
• 4.If the user makes a request for data portability, then it must be responded to without any delay and that too within one month. Owing to the complexity of the request, however, it could be extended to a maximum period of two months.

TRANSFERRING OF DATA OUTSIDE THE EU

• 1.The data to be transferred to a specific country or territory must have adequate level of data protection.
• 2.The European Commission approves the list of countries that observe adequate level of data protection. This list is reviewed by the European Commissioner every 4 years.
• 3.The commission keeps on monitoring the ongoing development happening in the approved countries and international organizations for such development can impact the decision to be taken by the commissioner.

DATA PROTECTION IMPACT ASSESSMENT (DPIA)

• 1.The DPIA is a tool, which can help organizations identify the most effective way to comply with their data protection obligation and meet the expectation laid by GDPR mainly in terms of privacy and protection.
• 2.DPIA is mainly triggered when a new technology is introduced or if there are certain amendments made to the existing infrastructure or at the inception of a project.
• 3.The triggering of DPIA will help us make informed decisions about the accountability of data protection and risks that are associated with it.
• 4.It helps in identifying and mitigating risks and plans for implementing the appropriate solutions to the risks that are identified and assess the possibility.
• 5.The Data Controller (DC) is responsible for ensuring that the DPIA is carried successfully.
• 6.DPIA could be triggered by internal expertise or external consultant should be hired.

BREACH NOTIFICATION

• 1.In case of any breach, it is necessary that the organization notifies the Supervisory Authority, especially if it is likely put the rights of the users at stake.
• 2.The notification to the users will be triggered, when the rights of the user are at risk.
• 3.The notification is to be sent within 72 hours of the organization becoming aware of the incident to the supervisory authority and to the users.

GDPR IMPLICATIONS-BASED GEOGRAPHICAL LOCATION

• 1.The GDPR applies to all the companies, institutions and organizations that are based within the European Union.
• 2.This applies to all the people residing within the limits of the European Union, irrespective of their citizenship.
• 3.The companies, institutions and organizations that are outside EU, but are providing any sort of services to the European nations, are liable for complying with the norms of GDPR.
• 4.Companies that do not store user data, but process data on behalf of some other organization(s), are also required to follow the norms of GDPR.

AWARENESS AND TRAINING

Companies must create awareness among employees regarding the key GDPR requirements by conducting awareness program for the employees; this will make them aware of their responsibilities related to the protection of data and identification of data breaches.

WHAT IS GDPR?

The European Union (EU) in the month of April 2016 brought into effect what can be called as Europe’s biggest IT reform and compliance yet. It is aimed at organizations globally and pertains to information being collected on EU citizens. The GDPR framework puts its emphasis on why information on EU citizens is collected and how organizations plan to use it.

IS ABARA LMS GDPR COMPLIANT?

Abara is aware of the GDPR requirements and restrictions and is completely compliant with the regulation as of January 2020. The methods and consent of collecting data and processing it are solely provided by the customers. The collection and processing of data can be governed by a contract between the customer and Abara.

WHAT DOES ABARA DO WITH YOUR INFORMATION?

As per GDPR guidelines, Abara does not sell or monetize your personal data in any way. Abara does not use your information to direct selective advertisements, promotional offers, political, philosophical or religious messages towards you. Furthermore, only the information that is truly important to the functioning of the tool is collected with prior opt-in and consent.

WHY DOES ABARA STORE AND PROCESS ANY PERSONAL DATA?

Abara does not need or process any personal data. Furthermore, any data loaded onto the platform can be protected and governed by a contract between the controller and Abara. However, for a digital content development platform such as Abara, the ability to track and identify users is important in order to provide sensible outputs to the right user.

WHAT DATA DOES ABARA STORE AND PROCESS?

As a data processor Abara stores and processes data of content developers who are registered as current and future users. These people include authors and co-authors. The exact type of information depends on the specific reports and analytics that must be generated for output purposes. The type of data that is required is email, address, first names, and last names. In addition to this, details regarding the author’s job roles, department, location, and other information fields that the customer deems as necessary to be included in the reporting and analytics feature are collected, this is strictly on the customer’s request.

DOES ABARA STORE ANY SENSITIVE DATA?

No. Abara requires information that is important to the basic working of the content development functionality, i.e.: name, last name, email id, job role, department, location, and other information that the customer deems important as a part of the reports. Information on the ethnicity, political views, sexual preferences, biometrics, philosophical and religious views are deemed as irrelevant and not collected by Abara.

HOW DOES ABARA ADHERE TO THE GDPR REQUIREMENTS?

Abara follows a strict set of security measures which ensure the utmost protection of all information stored on the cloud and server system. For reference please view Security Applications. Furthermore, Abara does not transfer or share any personal information with third-party or external organizations. For citizens and people working within the European Union, all information is stored on servers present within the European borders.

WHO IS GDPR APPLICABLE TO?

GDPR is applicable to all organizations that are present within the EU and carry out active business within its territories. It is also applicable to all businesses which are not directly present within the EU but actively carry out business with members of the EU, or businesses which consider members of the EU as clients and business associates. This applies to any business which collects data of EU members for the process of KYC. GDPR also applies to all the people residing within the limits of the European Union, irrespective of their citizenship.

To further find out about the (GDPR) requirements and guidelines followed by Abara refer to the document: GDPR Guidelines.