Data Protection Officer

…hand always have to appoint a DPO, with the exception of courts who are acting in their judicial capacity. In addition, the legal norm to appoint a Data Protection Officer has a flexibility clause for Member States. These are free to decide whether a company has to appoint a Data…

Art. 70 GDPR – Tasks of the Board

…the Commission, any question covering the application of this Regulation and issue guidelines, recommendations and best practices in order to encourage consistent application of this Regulation; issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for further specifying the criteria and conditions for decisions based…

Art. 47 GDPR – Binding corporate rules

…activity, including their employees; expressly confer enforceable rights on data subjects with regard to the processing of their personal data; and fulfil the requirements laid down in paragraph 2. The binding corporate rules referred to in paragraph 1 shall specify at least: the structure and contact details of the group…

Art. 6 GDPR – Lawfulness of processing

…a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. 2Point (f) of the first subparagraph shall not apply to processing carried out by…

Art. 33 GDPR – Notification of a personal data breach to the supervisory authority

…the data protection officer or other contact point where more information can be obtained; describe the likely consequences of the personal data breach; describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse…

Art. 20 GDPR – Right to data portability

…which the personal data have been provided, where: the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1); and the processing is carried out by automated means. In exercising his…

Art. 17 GDPR – Right to erasure (‘right to be forgotten’)

…longer necessary in relation to the purposes for which they were collected or otherwise processed; the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;…

Art. 22 GDPR – Automated individual decision-making, including profiling

…his or her point of view and to contest the decision. Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) or (g) of Article 9(2) applies and suitable measures to safeguard the data subject’s rights…