Does every business need to deal with GDPR?

Čo v článku nájdete:

• Who needs GDPR documentation?
• Personal data protection in “all” companies?
• Do I need GDPR documentation and personal data protection?

In practice, we still often receive questions from businesses about whether they need to address GDPR and personal data protection. Which business entity is required to prepare and maintain GDPR documentation?

Who needs GDPR documentation?

Under the GDPR Regulation, personal data protection must be addressed by every controller processing the personal data of individuals. In other words, every business that works with any personal data relating to an individual.

This is not only a direct client who is an individual, but also, for example, an individual acting as a representative of a legal entity. It also includes a person entering monitored premises, a website visitor where cookies or other contact details are collected, and many other situations in which personal data is processed.

How can you find out whether you need GDPR documentation? Simply ask yourself whether you process personal data. Under the GDPR Regulation, personal data means any identifier by which an individual can be identified. This includes a first and last name, an email address, a telephone number, a date of birth, or an image captured when entering premises.

Personal data is commonly processed in the following situations:

• processing orders,
• handling complaints,
• issuing invoices or other accounting documents,
• responding to a contact form on a website,
• processing payroll and HR,
• maintaining accounting records,

where the data relates to a data subject—an individual who can be identified through the processed personal data.

Personal data protection in “all” companies?

Almost every business entity processes personal data and should therefore address GDPR. Depending on the “volume” of processing operations, documentation and measures are adopted that are proportionate to the scope of the processing. Let us break this down. Article 1 of the GDPR states:

“This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data.”

The individuals whose personal data is processed (your clients, visitors, employees and others) are referred to by the GDPR as data subjects. The GDPR therefore lays down rules for protecting individuals when their personal data is processed. Under the GDPR Regulation, protection is provided to all individuals, and businesses are required to adopt measures to protect them.

Do I need GDPR documentation and personal data protection?

We can conclude that GDPR affects almost every business entity and a large number of other organisations.

Nevertheless, in practice we still often encounter the question of whether GDPR applies to a particular company. The answer is simple: if you process personal data of data subjects (individuals) through which you can identify a specific person, GDPR must be addressed.

To fulfil the obligations arising from GDPR, it is particularly necessary to:

• identify the company’s obligations—what personal data it processes, how it processes it, to whom it provides it and how it protects it,
• prepare GDPR documentation and adopt it by implementing it in the company’s operations,
• update and maintain GDPR documentation,
• pay attention to the security and protection of the personal data being processed.