book

EU General Data Protection Regulation (GDPR) – An implementation and compliance guide, fourth edition

by IT Governance Privacy Team

October 2020

Intermediate to advanced

386 pages

6h 32m

English

IT Governance Publishing

Read now

Unlock full access

The purpose of the GDPRStructure of the RegulationImpact on the EUImplementing the GDPRA note on the UK and BrexitKey definitions
Scope of the GDPRController and processorData controllersJoint controllersData processorsControllers that are processorsControllers and processors outside the EURecords of processingDemonstrating compliance
Principle 1: Lawfulness, fairness and transparencyPrinciple 2: Purpose limitationPrinciple 3: Data minimisationPrinciple 4: AccuracyPrinciple 5: Storage limitationPrinciple 6: Integrity and confidentialityAccountability and compliance
Fair processingThe right to accessThe right to rectificationThe right to be forgottenThe right to restriction of processingThe right to data portabilityThe right to objectRights in relation to automated decision-making

Material scopeTerritorial scopeGovernanceObjectivesKey processesPersonal information management systemsISO/IEC 27001:2013Selecting and implementing a compliance frameworkImplementing the framework
Personal data breachesAnatomy of a data breachSites of attackSecuring your informationISO 27001NIST standardsTen Steps to Cyber SecurityCyber EssentialsThe information security policyAssuring information securityGovernance of information securityInformation security beyond the organisation’s borders
Consent in a nutshellWithdrawing consentAlternatives to consentPracticalities of consentChildrenSpecial categories of personal dataData relating to criminal convictions and offences
Receiving a requestThe information to provideData portabilityResponsibilities of the data controllerProcesses and proceduresOptions for confirming the requester’s identityRecords to examineTime and moneyDealing with bulk subject access requestsRight to refusalThe process flow
Voluntary designation of a data protection officerUndertakings that share a DPODPO on a service contractPublication of DPO contact detailsPosition of the DPONecessary resourcesActing in an independent mannerProtected role of the DPOConflicts of interestSpecification of the DPODuties of the DPOThe DPO and the organisationThe DPO and the supervisory authorityData protection impact assessments and risk managementIn-house or contract
Objectives and outcomesFour elements of data flowData mapping, DPIAs and risk management
DPIAsConsulting with stakeholdersWho needs to be involved?Data protection by design and by default
DPIAs as part of risk managementRisk management standards and methodologiesRisk responsesRisk relationshipsRisk management and personal data
Five key stages of the DPIAIdentify the need for the DPIAObjectives and outcomesConsultationDescribe the information flowIdentify privacy and related risksIdentify and evaluate privacy solutionsSign off and record the outcomeIntegrating the DPIA into the project plan
Key requirementsAdequacy decisionsSafeguardsBinding corporate rulesStandard contractual clausesLimited transfersCloud services
NotificationEvents vs incidentsTypes of incidentCyber security incident response plansKey roles in incident managementPrepareRespondFollow up
The hierarchy of authoritiesOne-stop-shop mechanismDuties of supervisory authoritiesPowers of supervisory authoritiesDuties and powers of the European Data Protection BoardData subjects’ rights to redressAdministrative finesThe Regulation’s impact on other laws
Transition frameworksUsing policies to demonstrate complianceCodes of conduct and certification mechanisms
Publishing servicesCertified GDPR training and staff awarenessIT Governance training centreProfessional services and consultancyNewsletter

Content preview from EU General Data Protection Regulation (GDPR) – An implementation and compliance guide, fourth edition

APPENDIX 1: INDEX OF THE REGULATION

Chapter I – General provisions

1.Subject-matter and objectives

2.Material scope

3.Territorial scope

4.Definitions

Chapter II – Principles

5.Principles relating to processing of personal data

6.Lawfulness of processing

7.Conditions for consent

8.Conditions applicable to child’s consent in relation to information society services

9.Processing of special categories of personal data

10.Processing of personal data relating to criminal convictions and offences

11.Processing which does not require identification

Chapter III – Rights of the data subject

Section 1 – Transparency and modalities

12.Transparent information, communication and modalities for the exercise of the rights of the data subject

Section 2 – Information ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Start your free trial

EU General Data Protection Regulation (GDPR): An Implementation and Compliance Guide - Second edition

ITGP Privacy Team

EU General Data Protection Regulation (GDPR), third edition - An Implementation and Compliance Guide

IT Governance

Data Protection and Compliance, 2nd Edition

Stewart Room, Michelle Maher, Niall O'Brien, Adam Panagiotopoulos, Shervin Nahid, Richard Hall, Tughan Thuraisingam, James Drury-Smith, Simon Davis, Mark Hendry, Jamie Taylor, Ben Johnson

Information Security Policies, Procedures, and Standards

Douglas J. Landoll

Publisher Resources

ISBN: 9781787782501Supplemental Content