Privacy by Design & Data Sharing
A processor needs permission to use another one
A processor cannot bring in a sub-processor to help handle your data without the original company's prior authorisation - general or specific, but always documented.
Privacy by Design & Data Sharing
A data processor needs a written contract
Whenever a company hands personal data to a processor to handle on its behalf, GDPR requires a written contract spelling out exactly what the processor can and cannot do with it.
Privacy by Design & Data Sharing
Collect only what you actually need
Data minimisation means only collecting personal data that is adequate, relevant, and limited to what's necessary for the purpose - nothing extra just in case.
Privacy by Design & Data Sharing
One court ruling reshaped global data transfers.
The 2020 Schrems II ruling invalidated the EU-US Privacy Shield framework overnight, forcing thousands of companies to rebuild how they transferred data across the Atlantic.
Privacy by Design & Data Sharing
Privacy has to be built in, not bolted on
Data protection by design means privacy safeguards have to be built into a system from the very start of development, not added on afterwards as an afterthought.
Privacy by Design & Data Sharing
GDPR requires data protection by design and by default.
Privacy and data protection must be built into the development of processes, products, and services from the very start. This means companies must ensure that privacy settings are at the highest standard by default.