GDPR Compliance Statement

 

Introduction

The EU General Data Protection Regulation (“GDPR”) will enter into force across the EU on 25. ^th May 2018 and brings with it the most significant changes to data protection legislation in two decades. Based on privacy by design and a risk-based approach, GDPR is designed to meet the demands of the digital age.

The 21st ^st The 21st century brings with it broader use of technology, new definitions of what constitutes personal data, and a major increase in cross-border processing. The new regulation aims to standardize data protection laws and processing across the EU. give individuals stronger and more consistent rights to access and control their personal information.

Our commitment

FEC Consulting ('we' or 'us' or 'our') is committed to ensuring the security and protection of the personal information we process and to providing a compliant and consistent approach to data protection. We have always had a robust and effective data protection program that complies with applicable law and adheres to data protection principles. However, we recognize our obligations to update and expand this program to meet the requirements of GDPR and Danish, French, Polish, German, Portuguese, Italian data protection laws.

FEC Consulting is dedicated to protecting the personal information under our mandate and to developing a data protection system that is effective, fit for purpose and demonstrates understanding and appreciation of the new regulation. Our preparation and objectives for GDPR compliance are summarized in this statement and include the development and implementation of new data security roles, policies, procedures, controls and measures to ensure maximum and ongoing compliance.

How we prepare for GDPR

FEC Consulting has We already have a consistent level of data protection and security across our organization, but our goal is to be fully compliant with GDPR by the end of the year May 25, 2018 . Our preparation includes: -

• Information Audit - conduct a business-oriented information audit to identify and assess what personal information we have, where it comes from, how and why it is processed and whether and to whom it is disclosed.
• Policies and procedures - implementation of new data protection policies and procedures to meet the requirements and standards of the GDPR and any relevant data protection laws, including: -
  • Data protection - our main data protection policy and procedure register has been revised to comply with GDPR standards and requirements. Accountability and governance responsibilities are in place to ensure that we understand and adequately communicate and document our obligations and responsibilities; with a dedicated focus on privacy by design and the rights of individuals.
  • Data Retention & Erasure - We have updated our retention policy and planning to ensure we meet the principles 'data minimization' and 'storage limitation' , and that personal information is stored, archived and destroyed in a compliant and ethical manner. We have dedicated deletion procedures in place to accommodate the new "Right to Erasure" obligation and is aware of when this and other data subject rights apply. together with any exceptions, response pu and notification responsibilities.
  • Data burns - our breach procedures ensure that we have safeguards and measures in place to identify, assess, investigate and report personal data breaches as quickly as possible. Our procedures are robust and have been communicated to all employees, making them aware of the reporting lines and the steps to follow.
  • International data transfers and third-party information - where FEC Consulting store or transfer personal information outside the EU, we have robust procedures and safeguards in place to secure, encrypt and maintain data's integrity. Our procedures include an ongoing review of countries with sufficient adequacy decisions, as well as provisions for binding corporate rules; standard data protection clauses or approved codes of conduct for these countries without. We perform rigorous due diligence checks with all recipients of personal data to assess and verify that they have appropriate safeguards in place to protect the information, ensure enforceable data subject rights, and have effective legal remedies for data subjects where applicable.
  • Subject Access Request (SAR) - We have revised our SAR procedures to accommodate the revised 30-day timeframe for providing the requested information and to make this provision free of charge. Our new procedures describe how to verify the data subject, what steps need to be taken to process an access request, what exceptions apply, and a range of response templates to ensure communications with data subjects are compliant, consistent and appropriate.
• Legal basis for processing - We review all processing activities to identify the legal basis for processing and ensure that each basis is appropriate for the activity to which it relates. Where applicable, we also maintain records of our processing activities that ensure that our obligations under Article 30 of the GDPR and Schedule 1 of the Data Protection Act are met.
• Privacy Policy - We has revised our Privacy Notice(s) to comply with GDPR, and ensures that all individuals whose personal information we process have been informed about why we need it, how it is used, what their rights are, who the information is described to and what safeguards have been put in place to protect their information.
• Obtaining consent - We has revised our collaborative mechanisms for collecting personal data and ensuring that individuals understand what they are providing, why and how we use it and providing clear, defined ways to consent to our processing of their information. We have developed strict processes for recording consent, ensuring that we can prove an affirmative opt-in along with time and date records; and it is easy to see and access a way to withdraw consent at any time.
• Direct Marketing - We has revised the wording and processes of direct marketing, including clear opt-in mechanisms for marketing subscriptions; a clear message and method for opting in and providing opt-out features on all subsequent marketing materials.
• Data Impact Assessments (DPIA) - where we process personal information that is considered high risk, involves large-scale processing or contains special categories/crime data; We have developed rigorous procedures and assessment templates for conducting impact assessments that fully comply with GDPR Article 35 requirements. We have implemented documentation processes that record each assessment, allowing us to assess the risk in the processing activity and implement mitigating measures to reduce the risk to the data subject.
• Processor agreements - where we use a third party to process personal information on our behalf ( i.e. payroll, recruitment, hosting, etc. ), We have developed compliant processor agreements and due diligence procedures to ensure that they ( as well as we ) meet and understand their/our GDPR obligations. These measures include initial and ongoing reviews of the service provided, the necessity of processing, the technical and organizational measures and compliance with the GDPR.
• Special Categories Data - Where we collect and process any special category information, we do so in full compliance with the requirements of Article 9 and have high-level encryption and protections in place on all such data. Specific categories of data are only processed where necessary and only processed where we have first identified the relevant Article 9(2) or Data Protection Scheme List 1 condition. Where we rely on consent for processing, this is explicit and confirmed by a signature, with the right to change or withdraw consent clearly signposted.

Data Subject Rights

In addition to the above policies and procedures that ensure individuals can enforce their data protection rights, we provide easy access to information via our website on the individual's right to access personal information, such as FEC Consulting processes them and to request information about: -

• What personal data do we have about them?
• Purpose of the treatment
• The personal data in question
• Recipients to whom the personal data is/will be disclosed
• How long do we intend to store your personal data for?
• If we did not collect data directly from them, information about the source
• The right to have incomplete or inaccurate data about them corrected or completed and the process for requesting this
• The right to request the deletion of personal data ( if applicable ) or to restrict processing in accordance with data protection legislation, as well as to object to any direct marketing from us and to be informed about any automated decision-making that we use
• The right to lodge a complaint or seek legal redress and who to contact in such cases

Information security and technical and organizational measures

FEC Consulting takes the privacy and security of individuals and their personal information very seriously and takes all reasonable precautions and precautions to protect and secure the personal data that we process. We have robust information security policies and procedures in place to protect personal information from unauthorized access, alteration, disclosure or destruction and have multiple layers of security measures in place, including: -

SSL certificate on our websites, password policy, encryption, authentication, etc.

 

GDPR roles and employees

FEC Consulting has appointed Erik Bjeld like ours data protection officer (DPO) to develop and implement our roadmap to comply with the new data protection regulation. Our Data Protection Officer is responsible for promoting awareness of GDPR across the organization, assessing our GDPR readiness, identifying any gap areas, and implementing the new policies, procedures, and measures.

 

FEC Consulting understands that continuous employee awareness and understanding is essential for GDPR's continued compliance and has involved our employees in our preparation plans. We have implemented an employee training program specific to it that must be provided to all employees by the 25th. ^May 2018, and is part of our induction and annual training program.

If you have any questions about our preparation for GDPR, please contact Erik Bjeld.