Fully document the GDPR and data protection

Data protection is the legal right to the protection of personal data. It serves to protect the privacy and personal rights of individuals by ensuring that personal data is processed only for legitimate purposes and is protected accordingly.

The General Data Protection Regulation (GDPR) is an EU regulation that came into force on 25 May 2018 and harmonises the protection of personal data across the EU. It sets out how companies, organisations and public bodies must handle personal data. This includes, amongst other things, the duty to provide information, the duty to obtain consent, the duty to erase data and the duty to report data breaches.

The GDPR applies to all organisations that process personal data of EU citizens, regardless of where the organisation is based. Organisations must ensure that they comply with all the requirements of the GDPR and may be held liable if they fail to do so.

In short: data protection refers to the protection of personal data, and the GDPR is an EU-wide regulation that governs how personal data must be handled.

The GDPR came into full effect on 25 May 2018. As organisations processing personal data, companies and law firms are subject to accountability under Article 5(2) of the GDPR. This means that, as the data controller, you must be able to demonstrate compliance with the following principles:

1. Lawfulness, processing in good faith, transparency
2. Earmarking
3. Data minimisation
4. Accuracy
5. Storage limit
6. Integrity and confidentiality

You can demonstrate this accountability by providing data protection documentation that is appropriate in both form and content.

The GDPR essentially sets out the following documentation requirements:

• Balancing of interests and change of purpose
• Consent given
• Rights of those affected
• Compliance with the duty to provide information
• Right to rectification
• Right to erasure
• Restriction of processing
• Obligation to notify third parties
• Right to data portability
• Withdrawal of consent
• Exercising the right to object
• Technical and organisational measures
• Appointment of a Data Protection Officer
• Data Processing Agreement
• Data breach notifications

and much more.

Given this wealth of documentation requirements, it is important not to lose track of things and to ensure that documentation is complete. Nevertheless, the use of simple Word templates should be avoided, as these are neither dynamic nor specific enough to take into account and reflect all aspects and processes of a business.

Understanding GDPR Documentation

On our programme „hsp live at 11“, data protection expert Hendrik Sievers explained what is important when it comes to data protection in relation to documentation.

Whether you wish to handle data protection documentation yourself or have appointed a data protection officer, the solution is Opti.Tax.

With the Opti.Tax taxonomy software, you’re not bringing a standalone solution into your organisation, but a powerful tool that can be expanded over the long term. Practical and fair: you don’t have to purchase the whole package straight away, but can add additional modules as and when you need them.

The Data Protection & Documentation module in Opti.Tax offers the ideal software solution, in which every requirement is explained and implementation within the organisation can be tracked. Tackle the issue of data protection documentation properly now. With Opti.Tax, you get the GDPR documentation solution that will take further tasks off your hands in the long term: procedural documentation, e-balance sheet, Federal Gazette, liquidity advice, transfer pricing documentation (optional CbCR, Pillar 2), Money Laundering Act (GwG) and more. Everything from a single source, with no disruption to your workflow.