Topics

Topics — your privacy matters organized and monitored

What's the situation at your business?

Choose the situation that matches your business. Each topic answers one question, with the reference to the regulation included.

A customer is requesting a processor agreement

• Should I sign a processor agreement that my customer sends me?
• What must a processor agreement contain?
• Am I a processor or a controller?
• May my supplier process data outside the EU?
• can I amend a processor agreement that has already been signed
• what happens if I don't have a processor agreement with my supplier
• do I need to conclude a processor agreement with my accountant
• how do I know if the software I use complies with the GDPR
• can a processor agreement also be agreed orally or by email

There may be a data breach

• What exactly is a data breach?
• When must I report a data breach to the Dutch Data Protection Authority?
• Must I inform the data subjects myself in case of a data breach?
• Must I also keep track of data breaches that I do not report?
• Is an email sent to the wrong recipient a data breach?
• I lost a USB stick with customer data — is that a data breach
• my laptop with customer data has been stolen what should I do now
• my business mailbox has been hacked do I need to report it
• my supplier reports a data breach do I also need to report it myself
• who is responsible for reporting a data breach within my company
• we have been hit by ransomware is that automatically a data breach
• what are the consequences if I don't report a data breach to the AP

Demonstrating privacy to someone else

• What must a processing register contain?
• How do I complete a customer's privacy questionnaire?
• What does a procurement process ask about privacy?
• do I as a self-employed person also need to keep a processing record
• the Authority for Personal Data is coming to inspect what must I be able to show
• when am I required to carry out a DPIA
• am I required to appoint a DPO for my company
• how do I demonstrate that I comply with the GDPR without an expensive certificate

Getting the basics in order

• Does the GDPR also apply to freelancers and small businesses?
• What must a privacy notice contain?
• What must I do when I receive an access request?
• How long may I retain application and personnel data?
• When may I process personal data?
• What security does the GDPR require of a small business?
• May employees put customer data into an AI tool?
• may I retain camera images of customers in my shop
• do I need consent to send customers a newsletter
• what information may I record in the personnel file of an employee