How to Comply with the GDPR: A Step-by-Step Guide in 7 Key Actions

The mapping of processing operations is a recommendation of the CNIL to measure the level of compliance with the GDPR thanks, among other things, to the information inserted in the Record of data Processing Activities.

Thus, it enables compliance to be monitored over time and to feed the register of processing activities to enable organisations to draw up action plans to ensure compliance.

The processing map must include, as a minimum, the information that must be included in the register of processing activities, in particular :

• the purpose of the processing
• the categories of data
• the data subjects
• the recipients of the data
• the security measures applied to the processing

Determining the purpose of its personal data processing is an essential obligation imposed by the GDPR. The purpose of a data processing operation answers the question why is my company collecting this data?

Thus, collecting data from prospects via a website form is an action whose general purpose may be commercial prospecting and whose specific purpose is to make contact in order to sell a good or a service.

Firstly, the declared purpose of a processing operation sets the limit. It is indeed forbidden to process data for purposes incompatible with the initial purposes.

In addition, the purposes of the processing operations carried out must be declared in the register of processing operations and brought to the attention of the data subjects.

Finally, the duration of data retention depends directly on this purpose. Indeed, it is forbidden to keep personal data longer than is necessary to achieve the declared purpose.

Any person whose personal data are processed has the right to obtain from the controller a certain amount of compulsory information concerning the processing operations in question and the rights of that person with regard to his or her data.

In the context of employment relationships, the employer is necessarily a data controller of his employees’ data: both the employment contract and the labour code oblige the employer to process certain data (staff register, payroll, evaluations, etc.).

In the context of relations with its customers, a company will also be responsible for processing their data, even if it is only data relating to the follow-up of the contract.

The GDPR agrees on limiting the retention of personal data over time. Indeed, they indicate that the retention must be proportionate to the purpose of the processing.

• Current archiving: Routine archiving refers to the need for data to be retained by the data controller in relation to the purpose of the processing. This period may be fixed contractually between the controller and the data subject.
• Intermediate archiving: Intermediate archiving refers to the case where data can be kept longer than the period initially provided for contractually. This is the case when the law establishes a longer period than that provided for in the contract.
• Permanent archiving: Some data cannot be permanently destroyed. This is particularly the case for data of public interest (historical, scientific, statistical)

Some laws set a retention period. In the absence of such laws, the controller is obliged to set a period of time that is proportionate to the objective and purpose. Once this period has been exceeded, the controller must delete or anonymise the personal data of the persons concerned.

It should be remembered that the retention period for personal data begins when the contractual relationship ends or when the processing operation is completed.

Examples of retention periods :

• Data relating to payroll management: 5 years (Article L3243-4 of the Labour Code)
• Personal data of prospects: 3 years if they have not responded to any solicitation for at least 3 years
• Data processed by public or private health establishments: 20 years (Article R.1112-7 of the Public Health Code)
• Data relating to personnel management: 5 years (Article R.1221-26 of the Labour Code)
• Tax data: 6 years (Article L102 B of the Tax Procedures Book)
• Electronic contracts: 10 years (Article L213-1 of the Consumer Code)
• Video surveillance data: 1 month (Article L.252-3 of the Internal Security Code)

Any processing of personal data must have a legal basis.

Unlike the purpose of processing, which indicates the business objective of the processing, the legal basis is the legal title, the reason that authorises your company to process this data.

Please note: as the legal bases for using an individual’s information are listed exhaustively in the GDPR, it is important to identify the appropriate legal basis, or not to process the data if this legal basis does not exist/no longer exists.

This could be, for example, the consent of the individual, or the requirements of the performance of a contract.

The lawful basis for processing must be made known to the data subject, and included in the record of processing activities to demonstrate that personal data is processed with respect for

The obligation to obtain the consent of the persons concerned is one of the legal bases provided for by the General Data Protection Regulation. This consent authorises the implementation of personal data processing and can be collected in different ways (checkbox, handwritten signature etc.)

The GDPR defines data subjects’ consent as “any freely given, specific, informed and unambiguous indication of his or her wishes by which the data subject signifies his or her agreement to personal data being processed”.

The GDPR has not fundamentally changed the notion of consent of data subjects, but rather consolidated its definition by adding safeguards, including :

• • The right to withdraw: the possibility for the data subject to withdraw his or her consent whenever he or she wishes
  • Proof of consent: The data controller must be able to demonstrate at any time that the person has consented (Article 7 § 1 of the GDPR)
  • Explicit consent: the consent of the data subject must be explicit, which must be manifested by an express declaration. This implies the implementation of specific mechanisms by the controller to obtain such consent. Explicit consent is necessary to process sensitive data, for example
  • Consent of minors: Age limits vary across EU Member States, ranging from 13 to 16 years. Below the applicable age, a person cannot lawfully consent to the processing of their personal data and requires both parental consent and the child’s own consent.

• The GDPR imposes 4 cumulative criteria for a valid request for consent:
  • Free: The consent of the data subjects of the processing must be free, in other words, they are free to accept or not the processing concerning them. It must not be coerced or influenced
  • Specific: Consent must only relate to the purpose to which the person is attached. In cases where a processing operation involves several purposes, the data subject must be able to consent to each of them
  • Informed: The data subject must have certain information before consenting, the controller must be able to provide him/her with certain information in order for the consent to be informed (the identity of the controller, the purposes pursued, the categories of data collected, the existence of a right to withdraw consent, whether or not the data collected are transferred to a country outside the EU)
  • Unambiguous: consent must be clearly expressed and unambiguous. The following do not constitute unambiguous consent: pre-ticked boxes; grouped consents (i.e. a single consent instead of several separate consents); inactivity (e.g. the absence of a response to an email does not constitute consent)

Let us take a typical case of vitiated consent. A person subscribes to a service and has to provide personal information to do so. On the face of it, the data will only be used to conclude and execute the service contract. However, profiling is carried out in order to send marketing information to subscribers.

This purpose is stated in an information notice which the individual is obliged to accept by clicking on a box “I consent to the processing of my data”. No reference to the information notice is made, the person has to contact the controller to obtain it.

In such a case, the person has not really consented to the processing of his or her data for marketing purposes, so the processing is unlawful.

Article 7(3) of the GDPR provides for the right of the data subject to withdraw consent. Furthermore, the data subject may request the controller to withdraw consent at any time. The latter is obliged to inform the data subject of his or her right to withdraw consent prior to the collection of consent.

Consent was already enshrined in the Data Protection Act, but the GDPR has strengthened the conditions for obtaining it, including the right to freely change one’s mind about the processing of data by the controller.

The GDPR establishes 6 legal bases for processing personal data, among them consent. In this respect, the lawfulness of the processing is not only admitted on the basis of the consent of the data subjects, it can be on the basis of the performance of a contract or in the legitimate interest of the controller. It is up to the controller to adapt the purpose of the processing to the appropriate legal basis.

Consent of data subjects collected before the entry into force of the GDPR on 25 May 2018 is considered valid as long as it meets the requirements provided for by the GDPR. Otherwise, the controller must ensure that the conditions required by the GDPR are met for the consent to be considered validly collected.

GDPR compliance is an ongoing process that involves clear mapping of data processing activities, defining purposes, informing data subjects, limiting data retention, selecting a legal basis, and obtaining consent. With EQS Privacy Cockpit, these steps can be managed efficiently, turning compliance into a real driver of trust and performance for your organization.