Data protection compliance that is completed once and never updated drifts away from actual processing over time. The documents should therefore be reviewed at regular intervals.
The first item is the data inventory. When a new product, supplier or marketing channel is added, the inventory should be updated, followed by privacy notices, consent flows and retention periods.
The second item is contracts with data processors. For cloud, call centre and analytics services, the processing terms, cross-border transfers and security commitments should be checked.
Finally, the incident response plan should be in writing. Who takes which step between detecting a breach and notifying the Board should be set in advance.
Related practice area: Internet Law
This article is general information and does not replace legal advice. Legal Notice