Key points
- The GDPR, applicable since 25 May 2018, requires under Article 5 that data be processed lawfully, fairly and transparently.
- Article 6 lists the legal bases: consent, contractual necessity, legal obligation, vital interests, public task or legitimate interest.
- The first step is to map your data and keep a record of processing activities that complies with Article 30.
- Article 32 requires security measures appropriate to the risk, for example pseudonymisation, encryption, access control, backups and regular testing.
- Articles 37 to 39 require certain organisations to designate a data protection officer (DPO).
- Your company must respond to requests for access (Art. 15), rectification (Art. 16), erasure (Art. 17) and portability (Art. 20).
Protecting personal data has become a daily challenge. The GDPR, a regulation that can seem complex, concerns you directly. You handle sensitive information and you want to avoid costly mistakes. You are looking for clear guidance to understand and apply these rules. It is not just a legal obligation: it is also a matter of trust with your clients.
How do you identify the data concerned? Which principles apply? What practical actions should you take? You need a precise and accessible guide to master the fundamentals.
This article takes you through it step by step. Clear explanations, practical steps and advice tailored to your professional situation. No more navigating complex legal texts. Here you will find practical answers to move forward calmly with GDPR compliance.
Understanding the GDPR legal framework
The GDPR, applicable since 25 May 2018, is a European regulation that aims to strengthen and harmonise the protection of personal data within the EU. Under Article 5 of the GDPR, companies must process data lawfully, fairly and transparently, among other obligations. Applying this regulation rests on several fundamental principles, such as data minimisation, purpose limitation and data accuracy. Before going further into practical implementation, you need to understand these legal foundations.The legal bases for processing
To process personal data lawfully, your company must rely on one of the legal bases set out in Article 6 of the GDPR:- The consent of the data subjects
- Contractual necessity
- Legal obligation
- Protection of vital interests
- A task carried out in the public interest or in the exercise of official authority
- The legitimate interests pursued by the controller
GDPR implementation: steps to comply
1. Map your data
The first step in applying the GDPR is to carry out a comprehensive inventory of the personal data your company collects and processes. This process includes identifying the categories of data, the sources of collection, the purposes of the processing and the recipients of the data. This mapping makes it possible to draw up a record of processing activities that complies with Article 30 of the GDPR. It is an essential basis for assessing the risks of the processing operations. You can consult a digital law lawyer to help you with this process.2. Identify appropriate security measures
Ensuring the security of personal data is necessary. Under Article 32 of the GDPR, companies must implement appropriate technical and organisational measures, such as:- Pseudonymisation and encryption of data
- Access control and strong authentication
- Regular data backups
- Periodic risk assessment
Internal roles and responsibilities
Designating a data protection officer (DPO)
Under Articles 37 to 39 of the GDPR, certain organisations must designate a data protection officer (DPO). The DPO plays a central role in handling data protection matters. The DPO monitors the compliance of the company’s practices and advises on meeting legal obligations.Training and awareness
Staff training is essential to ensure consistent application of the GDPR. All employees who process personal data must be informed of their responsibilities and of good practice to follow. Clear and transparent information on internal data protection policies must be made available to avoid any breach.Managing data subjects’ rights
Responding to requests from individuals
The GDPR gives individuals several rights, in particular the right of access (Article 15), the right to rectification (Article 16), the right to erasure (Article 17) and the right to data portability (Article 20). Companies must be able to respond to these requests effectively and quickly. You should put in place a system to handle these requests and ensure compliance with the time limits set by the Regulation, generally one month.Documenting compliance
Record of processing activities
As mentioned above, keeping a record of processing activities is necessary under Article 30 of the GDPR. This document must contain:- The name and contact details of the controller
- The purposes of the processing
- A description of the categories of data subjects and of personal data
- The categories of recipients of the data
- Transfers of data to third countries
- Data retention periods
- A description of the security measures
Privacy notice and consent
Companies must provide clear and transparent information about the processing of personal data. This includes, in particular, drafting accessible and understandable privacy policies. Where processing is based on consent, you must obtain consent that is freely given, specific, informed and unambiguous (Article 4(11) of the GDPR). Companies must also be able to demonstrate this consent (Article 7).FAQ on GDPR implementation
Which companies does the GDPR apply to?
All companies established in the European Union that process personal data are concerned, whatever their size. A company established outside the Union is also concerned when it offers goods or services to individuals in the Union or monitors their behaviour (Article 3 of the GDPR). This covers SMEs as well as large multinationals.
What are the penalties for GDPR non-compliance?
If they fail to comply with the GDPR, companies may face fines of up to €20 million or 4% of total worldwide annual turnover, whichever is higher. Additional administrative sanctions may also be imposed.
How can I check whether my company complies with the GDPR?
To check compliance, carry out a full audit of your data processing practices. Make sure that all aspects of the GDPR, such as the documentation of processing and security measures, are properly implemented. Consulting a data protection expert can be helpful.
What are users’ rights under the GDPR?
Under the GDPR, users have the right to access their personal data, to rectify it, to request its erasure, to restrict processing, to object to processing and to request data portability. These rights must be respected and support better management of personal data.
