umraniye escort pendik escort
maderba.com
implant
olabahis
canli poker siteleri meritslot oleybet giris adresi betgaranti
escort antalya
istanbul escort
sirinevler escort
antalya eskort bayan
brazzers
sikis
bodrum escort
Short Reads

Countdown 4 weeks until GDPR : Will data controllers be required to maintain records of processing activities in all cases?

Stibbe - Will data controllers be required to maintain records

Countdown 4 weeks until GDPR : Will data controllers be required to maintain records of processing activities in all cases?

26.04.2018 EU law

Only 4 more weeks to go before the GDPR becomes fully effective. Preparing your company for the application of this new regulation requires a correct understanding of its principles. Each week, we highlight one particular misconception regarding the interpretation of the GDPR.

Will data controllers be required to maintain ​r​ecords of ​processing activities in all cases?

The GDPR requires each controller to keep a record of processing activities under its responsibility, and each processor to keep a record of the processing activities that it has carried out on behalf of a controller​​. However, these obligations do not apply if the controller or the processor is an enterprise or an organization employing fewer than 250 persons, unless the processing it carries out:

- is likely to result in a risk to the rights and freedoms of data subjects and is not occasional, or

- includes sensitive​ data, i.e., personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation (Article 9​ of the GDPR), ​or data relating to criminal convictions and offences (Article 10​ of the GDPR).

​The rationale for these exceptions is that ​small and medium-sized enterprises and organizations that do not carry out risky processing should be exempt from the requirement to keep a record of its processing activities.

 

Stibbe, together with Chiomenti, Cuatrecasas, GIDE and Gleiss Lutz, have gathered this useful information, reflecting some common misconceptions about the implementation of the GDPR.

Team

Related news

04.03.2021 BE law
Erik Valgaeren speaks on personal data breaches in a webinar organised by the Academy of European Law

Seminar - On 24-26 March 2021 ERA (Adademy of European Law) organises an online Conference "Responding to Personal Data Breaches in the Post-GDPR era". Erik Valgaeren, our Brussels TMT partner, addresses the topic "Managing personal data breach in a complex international scenario", including cross border cases in the EU and breaches at non-EU establishments.  

Read more

12.02.2021 EU law
After the Uber case and the Airbnb case … the Star Taxi App case: focus on the question of the qualification as “Information Society Service”

Articles - Societal and digital developments are reflected in the case law of the CJEU. For several years now, European judges resolve disputes relating to digital applications and the services they provide. On 3 December 2020, they handed down a judgment in a case concerning Star Taxi App. This blog analyses the Star Taxi App case law in the light of the Uber case law and the Airbnb case law. The three judgments have in common the question of the qualification of services as Information Society Services.  

Read more