GDPR Practical Guidance on Basic Knowledge and Compliance
GDPR (General Data Protection Regulation) ，即《UniversalData protection条例》，Yes.European Unionon 2018 YearMinoriSchultz.It's...All球最TightTightIt's...Privacy protectionFrench。It's...No, no.仅适ForEuropean Union境内It's...Company，Yeah.适ForRen.What?InEuropean UnionHousing民ProvisionProductsorServices、or监控OtherOkay.YesIt's...境外Group织。
Why do your enterprises have to value GDP R?
- Big fines: Violations are punishable by a fine of up to Euro20 million or 4 per cent of the annual turnover worldwide (whichever is higher).
- Global standards: Many countries have their privacy laws (such as the PIPL in China and the LGPD in Brazil) that draw on GDP R, and achieve GDP R. Compliance often means that it is also consistent with most privacy laws around the globe.
- Business trust: In B2B cooperation, the certificate of compliance has become a “ticket” into the supply chain.
2. Core principles of compliance
The following principles must be followed in the processing of any personal data:
- Legitimacy, impartiality and transparency: There must be a clear legal basis and an honest message to users.
- Purpose limit: Data can only be used for the specific purposes stated at the time of collection.
- Minimization of data: Only the minimum amount of data necessary to achieve the purpose is collected.
- Storage limit: Data may not be retained for long periods of time after the purpose has been achieved.
3. Core rights of data subjects
According to GDPR, users (data subjects) have eight basic rights and enterprises must establish processes to respond to these requests:
- The right to know: To understand how the data are processed.
- Right of access: Get a copy of the personal data.
- Right of correction: Fixes the wrong data.
- Right to be forgotten (right to be deleted): In specific cases, data are requested to be deleted.
- (b) Restriction of the right to process: Requires to stop processing without deleting data.
- Right to data: Export data in machine-readable format.
- Right of reply: Data are denied for direct marketing, etc.
- Rights related to automated decision-making: The right not to be affected by pure algorithms.
Legal declaration: This list is for self-reference only and does not constitute a formal legal opinion. GDPR Compliance is a complex system engineering exercise, and it is recommended that professional privacy counsel be consulted in high-risk business scenarios.