ABCDEFGHIJKLMNOPQRSTUVWXYZ
1
GDPR ArticleDescription
2
Responsibilities of the controller regarding data protection24; 25the data controller needs to have in place technical and organisational measures to demonstrate compliance with the regulation. These measures, where possible, should be implemented by design and by default.
3
Joint Controllers26the responsibilities of each controller in relation to the duties generated by the data subject’s rights should be determined between them and the established terms made available to the data subjects.
4
Designation of representatives27the controllers and / or processors should designate a representative of one of the member states of the Union for the cases where the controller is not established in the Union.
5
Processing agreement with data processors28; 29the controller can establish contracts with processors, that have in place the appropriate security measures, for the processing to be carried out on behalf of them. This processing must be governed by a contract between controller and processor, that should include the subject-matter, duration, nature and purpose of processing, as well as the personal data types, categories of data subjects and the rights and obligations of both the data controller and the data processor.
6
Records of processing activities30; 31each controller, and each processor that are carrying processing activities on behalf of a controller, should keep a record of the processing activities, which must be available to the supervisory authorities when requested.
7
Notification of a data breach to the supervisory authority33the data controller has to notify the supervisory authority that a personal data breach has occurred and the processor should inform the controller without delay as soon as it is aware of a breach.
8
Communication of a data breach to the data subject34the data controllers have the obligation to inform the data subject about any data breach that results on a high risk to their rights and freedoms and this communication should include, at least, the nature of the breach and the measures that are being taken to mitigate it.
9
Data protection impact assessment (DPIA)35data controllers should draft an assessment of the impact of the processing activities, and respective risks to the protection of personal data, in the cases where they are going to perform an extensive evaluation of personal data
10
Prior consultation with the supervisory authority36the controller should consult the supervisory authority, prior to the processing, when the DPIA illustrates that the processing activities will result in a high risk to the privacy of the data subjects.
11
Designation of the DPO37each controller and processor should designate a data protection officer in the cases where the processing is carried out by a public authority or the core processing activities require systematic monitoring of the data subjects on a large scale or are related to the sensitive categories of data specified on Article 9 and 10.
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100