In this GDPR series, we dive deep into the key GDPR provisions and what they mean for your business. We also share some practical tips and tricks to help you comply with these provisions.
GDPR Data Processing Principles
Chapter 2 of GDPR lays down the principles related to data processing. Articles 5 to 11 provide information on how you can process the personal data of EU residents.
Here’s a brief look at each provision.
Article 5 – Principles Relating to Processing of Personal Data
As per the provisions of this article, you must process personal data lawfully, fairly, and transparently. It must be collected for ethical purposes, as per the specified reason. Also, the nature of data must be limited to what’s needed and must be stored in a format where it’s not traceable to an individual than is necessary for the stated purpose.
Article 6 – Lawfulness of Processing
Article 6 states that processing is considered lawful only if
- The data owner has given explicit consent.
- It is necessary to perform a contract in which the data owner is a party or for the public interest.
- It is required to meet the legal obligations and protect the vital interests of any EU resident.
- The processing meets your legitimate needs.
Article 7 – Conditions for Consent
You are responsible for proving that the data owner has consented to process data, and must be freely given. Also, the data owner can withdraw consent at any time.
Article 8 – Child Consent
Children over 16 years old can provide consent to process their data. If the child is under 16 years, consent must come from an adult with parental authority. Using the available technology and data, you can verify if the said individual has parental authority over the child.
Article 9 – Special Categories of Personal Data
This provision explicitly prohibits data processing that reveals an individual’s racial or ethnic origin, political opinion, religious belief, trade union membership, health conditions, or sexual orientation. These restrictions don’t apply if the individual has given explicit consent, collecting this data is necessary to carry out your obligations to the contract, and is necessary for the public interest.
Article10 – Processing of Personal Data Related to Criminal Convictions and Offenses
If you’re processing any criminal conviction or offense-related data, the Union, or member state must authorize it, and must be done only under the control of the official authority.
Article 11 – Processing Which Does Not Require Identification
If the data you’re processing does not identify a specific individual, you are not obliged to maintain, acquire, or process additional information.
Thus, these are GDPR’s data processing provisions.
Next, let’s look at what you must do to ensure compliance.
Actionable Insights to Comply with GDPR’s Data Processing Provisions
GDPR can seem overwhelming, especially if you process extensive personal information. Below are some actionable insights to comply with these provisions.
- Communicate your data processing activities through clear and accessible privacy policies.
- Collect and process data only for legitimate purposes, that align with the stated objectives.
- Collect only the required data.
- Have processes for prompt data correction or update.
- Establish data retention policies and delete the data that are no longer required.
- Use encryption, access controls, and other security measures to protect data integrity and confidentiality.
- Define the retention period for each type of personal data and adhere to them.
- Stay on top of your legal obligations for data processing.
- Document consent and other records to demonstrate compliance.
- Ensure your data owners provide consent freely. Provide them with the necessary information to make informed decisions.
- Provide options to withdraw consent at any time.
- Get the parental consent if a child is below 16 years old.
- Restrict access to sensitive information like criminal offenses and convictions.
- Understand and comply with the national laws.
- Use pseudonymization where possible to process data without identifying the subject.
- Consider using anonymized data when possible.
Based on your business and the nature of the personal data you handle, you can follow one or more of the above actions.
Final Words
Overall, GDPR’s data processing provisions ensure fairness, transparency, and adherence to existing Union and member state’s national laws. As GDPR is designed to protect individual privacy, it’s your responsibility as the organization collecting the data to prove that the data is necessary for your operations and that you have obtained free consent from the subject to use them.
We hope the action items provided in this article help you meet these provisions.