The GDPR is not exhausted by a privacy policy on a website. A business has to know what personal data it processes, for what purpose and on what legal basis, and it must also be able to show that it applies appropriate protective measures. A data protection lawyer assesses the legal basis for the processing, the documentation obligations and the measures required, according to the nature and the risk of the processing.
A privacy policy is only one part of compliance. Depending on what the business does, it may need records of processing activities, Data Protection Impact Assessments (DPIAs), procedures for handling data subject rights requests and a Data Protection Officer (DPO). Real compliance lies in the procedures that are applied in practice and in the documentation that can be produced in the event of an audit or a complaint.
A privacy policy on a website is not the same as a GDPR compliance programme. Real compliance is judged by the procedures, by the measures actually applied and by the documentation available when it is needed. Cybersecurity adds a further layer of requirements. NIS2 has widened the range of businesses and organisations that may be subject to specific cybersecurity obligations, depending on their sector, size and activity. For businesses within its scope, appropriate risk-management measures and incident response and reporting procedures are required.
Cross-border transfers of personal data also call for particular care. Where data is transferred outside the EEA — to a cloud provider, a group company or a partner outside the EU, for example — an appropriate transfer mechanism has to be in place and the relevant GDPR conditions have to be met. Standard Contractual Clauses (SCCs) are one of the principal mechanisms for such transfers, but their use has to be assessed against the specific circumstances of the transfer. If a personal data breach occurs, the business has to assess the incident immediately and, where the conditions are met, notify the breach to the Hellenic Data Protection Authority within the prescribed time limit. Having the right procedures in place before an incident can make a material difference to how it is handled. We advise businesses on data protection and cybersecurity, from the design of policies and procedures through to cross-border transfers, processing agreements and incident response. Our experience from the in-house side at a multinational technology group shapes a practical approach: what the law requires, what has to be done in practice and how it can be documented.
Not a filing exercise
GDPR compliance is a programme, not a document
Records of processing activities, lawful basis documentation and Data Protection Impact Assessments (DPIAs) are part of the documentation a business has to be able to produce if it is audited. A published privacy policy, on its own, is not enough.
Expanded scope
NIS2 widens the scope of cybersecurity obligations
The NIS2 framework now covers more sectors and businesses than the previous regime, including certain digital services, manufacturing businesses and other entities that meet the prescribed criteria. The obligations depend on the sector, the size and the category of the entity.
Post-Schrems II
Cross-border transfers need an appropriate legal mechanism
Moving personal data outside the EEA requires an appropriate legal basis and, where Standard Contractual Clauses (SCCs) are used, an assessment of the circumstances of the particular transfer and of the risks involved. A general clause in a vendor's terms is not enough on its own.