GDPR Compliance

Are you looking for a solution that will help you to process the personal data of your customers or employees in accordance with the General Data Protection Regulation? With the GDPR Compliance, you have full control of the personal data of your customers and employees. We also offer the processing of documentation with respect to individual company processes.

GDPR Compliance ensures that only authorized users have access to personal data. At the same time it facilitates the easy portability of personal data and irretrievable erasure. For each personal data, it is recorded the date of acquisition, the purpose for which it is processed and which condition was fulfilled for its processing. The date of erasure is also defined for each personal data. All operations of personal data processing are logged and can easily be submitted to the supervisory authorities.

The key benefits of the GDPR Compliance are described in more detail below:

1. Personal data sets;
2. Conditions of the personal data processing;
3. Categorization of documents;
4. Report of the personal data without fulfillment of any condition of processing;
5. Logging of the personal data processing;
6. Two-factor authentication;
7. HTTPS;
8. Advanced user permissions;
9. Automatic acquisition of consents;
10. Portability of personal data;
11. Erasure of personal data;
12. Pseudonymisation of personal data.

For more information about the General Data Protection Regulation, read the GDPR article.

Personal data sets

The key part of the GDPR Compliance is represented by the sets of personal data. Each set of personal data defines what personal data is processed, for what purpose, on what conditions and when they will be erased. Personal data sets contains personal data of each data subject across the system or information infrastructure (in case of the full integration). This is especially necessary when personal data of one data subject is processed in different modules or systems at the same time. Personal data sets may overlap, because individual personal data can be processed under several conditions at the same time. This may occur, for example, in a situation where you have the consent by the data subject with the processing of selected personal data and a legal obligation to process selected (same or different) personal data. With individual personal data sets, the system can easily find out what personal data must be erased when withdrawing the consent and what cannot be erased.

Conditions of the personal data processing

The conditions for the processing of personal data are specified in the Article 6 of the General Data Protection Regulation. The most frequent are probably consents, obligations on the basis of the contractual performance and legal obligations. Other conditions may be relevant in a situation where the data processing is necessary to protect the vital interests of the data subject, to fulfill a public interest or for the purposes of the legitimate interests. The controller must be able to demonstrate, which condition is fulfilled for the processing of personal data. The conditions are therefore linked to personal data sets in the GDPR Compliance solution. This makes it easy to find out, which condition is fulfilled for the processing of personal data, even if the conditions are overlapped. At the same time, this solution enables to have control over the erasure of personal data. The conditions for the processing of personal data should be time limited and GDPR Compliance can control the mandatory erasure of personal data.

Categorization of documents

According to GDPR, the data controller is required to know exactly what personal data is processed and where it is stored. If the controller uses only an information system with a precise definition of which fields contains personal data, the situation is very simple. Unfortunately, personal data is usually included in other sources, such as documents. The GDPR Compliance solution therefore includes the ability to categorize documents according to personal data that is contained. This allows us to ensure that only a user with the appropriate permission for specific personal data can work with the document. The GDPR Compliance solution is made up of administrative and user interfaces and custom document management functionality. In the administration, you can create document categories and assign them to personal data sets according to what personal data they contains. In the user interface, users can use categories created in the administration according to their permissions.

Report of the personal data without fulfillment of any condition of processing

Processes related to the processing of personal data require control mechanisms as well. Therefore, the GDPR Compliance solution includes the report of personal data with no processing condition defined. Personal data with no processing condition fulfilled is not allowed to be processed. The processor must ensure fulfillment of conditions. Within the control mechanisms, the report of the personal data without fulfillment of any condition of processing serves to that end. During a regular check, the processor can make an immediate remedy.

Logging of the personal data processing

The General Regulation specifies in Article 25 what operations with personal data, with what attributes and for what purposes must be logged. The controller and processor must be able to provide the logs on request to the supervisory authority. Logging refers to automated systems, at least for the following operations: collection, alteration, consultation, disclosure including transfers, combination and erasure. Specific requirements refer to consultation and disclosure. The logs of consultation and disclosure shall make it possible to establish the justification, date and time of such operations and, as far as possible, the identification of the person who consulted or disclosed personal data, and the identity of the recipients of such personal data. The General Regulation then restricts the use of the log for verification of the lawfulness of processing, self-monitoring, ensuring the integrity and security of the personal data, and for criminal proceedings. The GDPR Compliance solution allows you to log the operations with the required attributes.

Two-factor authentication

The GDPR requirements place emphasis on reducing the risk of leakage of personal data. One method that can help to reduce the risk is two-factor authentication. With 2-factor authentication, it is not enough only to get or break user access. The attacker must be able to access the email address or mobile phone of the corrupted user. As a result, the unauthorized access is more complicated, and the risk of personal data leaks decreases.

GDPR Compliance solution offers 3 possibilities of two-factor authentication:

1. SMS;
2. Email;
3. Google.

SMS authentication works in the standard way. User authenticates via the code in SMS. For the SMS distribution is used an external service. It is easy to connect to this service in administration. Sending SMS messages is charged. You can buy a credit and then draw from it. It is possible to check the current amount of the credit in administration. You can also set a notification when a certain credit limit is reached. So, the amount of credit does not need to be constantly manually checked.

Email authentication works similarly to SMS, with the exception that user receives the verification code via email. However, the e-mail is not charged. Unlike SMS authentication, there is a higher risk that a potential attacker will get access to the user mail box.

Google authentication means that logging into the system is only possible via a Google Account. In this case, the two-step verification will be used as it is set on Google Account.

HTTPS

Accessing the system through a secure protocol is another level of personal data protection. HTTPS (Hypertext Transfer Protocol Secure) is not part of the GDPR Compliance solution as it is done directly on the server where the solution is implemented. When using Cloud CRM, HTTPS can be set in default. If you are interested in using GDPR Compliance on your own server, we will help you with the necessary settings.

Advanced user permissions

Additional level of personal data privacy can be achieved by setting advanced user permissions. With GDPR Compliance solution, you can set user access only to necessary personal data sets. Through such settings, users who need to work with business records but who do not need personal data at the same time can also access the system.

Automatic acquisition of consents

For the processing of personal data, the GDPR requires that one of the conditions, including the subject’s consent, is met. The specific terms of consent are set out in Article 7 of the General Regulation. Importantly, you need to be able to demonstrate the consent if necessary. The GDPR Compliance solution facilitates the process of acquisition the consent, where the form of the consent can be a non-editable PDF document authenticated by a time stamp. For this purpose, you can create PDF templates according to company style.

The process of acquisition of consent can work, for example, as follows. The data subject enters the necessary personal data via the web form. Subsequently, a PDF document containing the data is generated. The document is provided with a time stamp and is sent to the data subject by e-mail. Part of the email is a link through which the data subject confirms its approval. This procedure is necessary to verify that the data subject actually agrees to the processing of personal data and that the form was not filled in by someone else. Because the process of obtaining of the timestamps is charged, GDPR Compliance includes an administrative interface with the option of setting whether and when to use the timestamps. It is possible to set whether the timestamp is added to the document before or after the data subject confirmed via link in email. A more secure option is to send a document to the data subject with a timestamp and then get verification of this non-editable document. Sending a time stamped document after verification is appropriate if you encounter abuse of the webform.

Portability of personal data

One of the new requirements for processing of the personal data is the portability. The controller should be able to provide personal data to data subject in a machine-readable form upon request. Probably the objective is to facilitate the transition of the data subject to another controller, who offers more favorable terms of cooperation. Thanks to personal data sets the GDPR Compliance solution makes the portability of personal data easy. For the portability, data can easily be exported to a machine-readable CSV or XLSX. If the personal data are included also in documents, these documents are generated in the zip archive.

The verification of the applicant is made before the export. Verification is via a time-limited verification code sent by SMS or email. After verification, it is sent a link to the page which provides the export to the data subject. For security reasons, export is not emailed. It is available only for a limited time via the download page. Even if someone gets a link later, export will no longer be available. During each export is logged information about what data was provided, when, to whom, by whom, for what reason and by what verification.

Erasure of personal data

Another requirement of GDPR is the right to be forgotten. If personal data is erased, it must be done irreversibly and the operation must be logged. This is what GDPR Compliance solution ensures. Functionality ensures the irreversible deletion of a set of personal data including linked documents across the system. At the same time, the functionality checks whether the personal data is processed under another condition and can be erased. For example, if personal data can not be deleted because of a legal obligation, the erasing is not allowed.

The functionality of erasing can ensure also the automatic erase of personal data for which no condition is already fulfilled for processing. Additionally, it is possible to set an email notification on the approaching date of erasing of the specific personal data. For example, if personal data is processed only on the basis of consent and the end of its validity expires, the user may be notified in advance and get the new consent from the data subject. For making a regular check whether all necessary deletions have been made, the report of the personal data without fulfillment of any condition of processing will help you.

Pseudonymisation of personal data

Pseudonymisation of personal data can be used in two ways. The first relates to pseudonymization in one system, the second relates to integration of multiple systems. The first is the deletion of personal data from the records, with the fact that the records themselves remain in the system, including important relations. The deletion of personal data is necessary unless a condition for their processing is no longer met. You can imagine this way of pseudonymization as a bluring the text in a document. This document is otherwise legible and can provide interesting information. The data, including relations that can be used in reports are kept in the system. However, these data can no longer be assigned to a particular person. This way of pseudonymization is part of the GDPR Compliance solution.

The second way of pseudonymization can be used in integration of multiple systems. In such a case, personal data is stored in only one system. Every person is assigned an identifier in this system, for example customer number. In other systems that work with those customers, there are no longer any personal data, but only the customer numbers. This reduces the risk of leakage of personal data because personal data is actually stored in only one well-secured system. If data leaks from these systems, personal data doesn’t leak. This way of pseudonymization is not part of the GDPR Compliance solution, because it must be implemented according to your custom information infrastructure. If you are interested in implementing this type of pseudonymization, we can help you.

Related services

1. Analysis of personal data processing;
2. Setting up the solution according the analysis;
3. Processing of documentation according to analysis.

Implementation options

The solution can be implemented individually or by installing into a compatible system.