Contents Knowledge map

Before you read

This site is NOT legal advice, and using it creates no lawyer and client relationship. It is a set of findings, checked against published sources and dated, that may help software developers and other individuals. For a decision that matters, ask a qualified lawyer in the country concerned.

European Union, for developers

Open in Knowledge map

Work through these for your project. The plain-language rules are on the European Union page.

Does it apply to you?

Do you have an establishment in the EU, offer anything to people there (free counts), or monitor what they do there? Then it does.1 If you are outside the EU and it applies, you generally have to appoint a representative in the EU.2

Are you the controller or the processor?

If you decide why and how data is used, you are a controller. If you handle it for someone else, you are a processor, which needs a contract with the controller.3

Build it in from the start

  • Name one legal reason for each purpose before you collect anything.4
  • Default to the minimum: data protection by design and by default is a legal duty.5
  • Tell people what you do, at the moment you collect it.6
  • Make the rights work: a route to export, correct and delete, inside one month.7

Keep it safe, and know what to do when it is not

  • Take security measures suited to the risk.8
  • Have a plan to report a breach within 72 hours where feasible.9
  • High-risk processing, particularly with new technology, needs a data protection impact assessment first.10

Know your records and roles

  • Keep records of processing. Having fewer than 250 staff exempts you only if the processing is occasional, is unlikely to create a risk, and involves no special categories or criminal data.11
  • Some organisations must appoint a data protection officer, including those whose core work is large-scale monitoring.12

Check where the data goes

Every third-party service that receives personal data outside Europe is a transfer you need a basis for.13

References

  1. GDPR, Article 3: Territorial scope ↩

  2. GDPR, Article 27: Representatives of controllers or processors ↩

  3. GDPR, Article 28: Processor ↩

  4. GDPR, Article 6(1): Lawfulness of processing ↩

  5. GDPR, Article 25: Data protection by design and by default ↩

  6. GDPR, Articles 13 and 14: Information to be provided ↩

  7. GDPR, Article 12(3) and (5): Transparent information and modalities ↩

  8. GDPR, Article 32: Security of processing ↩

  9. GDPR, Article 33(1): Notification to the supervisory authority ↩

  10. GDPR, Article 35(1): Data protection impact assessment ↩

  11. GDPR, Article 30(5): Records of processing activities ↩

  12. GDPR, Article 37(1): Designation of the data protection officer ↩

  13. GDPR, Article 44: General principle for transfers ↩