Appoint a dedicated Data Protection Officer (DPO) responsible for data protection governance, compliance oversight and the management of data subject requests
Maintain a Record of Processing Activities (ROPA) documenting the purposes, categories and legal bases of personal data processing, reviewed at least quarterly
Embed Data Protection Impact Assessments (DPIAs) into the development of new products, services and features to identify and mitigate privacy risk
Define and apply a data retention schedule by record type, ensuring personal data is retained only as long as necessary and securely destroyed or anonymised thereafter
Maintain a standard Data Processing Addendum (DPA), compliant with Article 28 GDPR, governing the processing of customer personal data, with international transfers safeguarded by EU-approved Standard Contractual Clauses (SCCs)
Maintain documented procedures for handling data subject rights requests, including access, erasure and portability, responding within statutory timeframes
Notify affected parties and applicable regulators of a personal data breach without undue delay, in accordance with customer contracts and regulatory obligations
Require all employees to complete data protection training at the time of hire and annually thereafter, including guidance on the responsible use of AI tools involving personal data
Stay in touch
Stay updated with the latest trends. Sign up for our newsletter.
