Data Protection Law (GDPR)

Personal data are any information that can lead to the identification of a natural person, such as name, personal identification number, email address, IP address, location data, biometric data, voice, image, etc. Even a customer code or an internal ID may be considered ‘personal data’ if it can be associated with an individual.

Yes. The GDPR applies to any data controller that processes personal data, not only to those that collect sensitive data. Seemingly innocuous data, such as an email address or a telephone number, also fall within its scope.

Individuals have several rights:

• the right of access to personal data,
• the right to rectification,
• the right to erasure (‘the right to be forgotten’),
• the right to data portability,
• the right to object
• the right not to be subject to automated decision-making.

The data controller is required to respond to such requests within a maximum of 30 days.

It must include: the identity of the data controller, the purposes of processing, the legal grounds, the recipients of the data, the retention period, the rights of data subjects, and information on international data transfers. The text must be clear, concise, and easy to understand.

Yes. Regardless of size, any company that processes personal data must comply with the GDPR requirements. This entails having internal policies, compliance documentation, a record of processing activities, and appropriate technical and organizational measures.