GDPR
The GDPR, duty by duty.
Eurus reads which of the GDPR's duties fall on a business, starts the breach and request clocks from the moment it becomes aware, and checks the records its systems make against 36 GDPR checks as they arrive.
Who it applies to
Regulation (EU) 2016/679 applies to any business established in the Union that processes personal data, and to a business outside it that offers goods or services to people in the Union or monitors their behaviour there (Article 3). In Ireland the Data Protection Commission supervises it, and the Data Protection Act 2018 gives it further effect.
Check how the GDPR applies to you
Controller or processor
A controller decides why and how personal data is processed. A processor processes it on a controller's behalf, under a contract that sets out what Article 28(3) lists. Many businesses are both, for different data.
A data protection officer
Article 37 asks for one where the core activities need regular and systematic monitoring of people on a large scale, or process special categories of data on a large scale, and for every public authority.
What it asks
A record of processing
Article 30: what is processed, why, about whom, who receives it, where it goes outside the Union, how long it is kept and how it is secured. A business under 250 staff keeps one too where its processing is regular, risky or touches special categories.
Security fit for the risk
Article 32: measures that fit the risk, such as encryption, access control, backups that restore, and testing that the measures work.
A breach report in 72 hours
Article 33: a personal data breach goes to the Data Protection Commission within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people. Article 34: the people affected are told without undue delay where the risk to them is high.
Requests answered within a month
Article 12(3): a request to see, correct or erase personal data is answered within one month, extendable by two further months where requests are complex or numerous.
An impact assessment before risky processing
Article 35: processing likely to result in a high risk to people, such as large-scale profiling or monitoring, is assessed before it starts.
Try this in a copy of your own, for two hours, with nothing to sign up for.
Open your own copyHow Eurus handles it
36 of the 72 checks follow a GDPR article, and run on each record as it arrives: an enquiry, a payment, an email, a change of access.
Each record checked
Extra and sensitive fields, card numbers in messages, marketing sent without consent, and admin access without an approver each fail their check at once.
The clocks from awareness
A controller's breach starts the 72 hours. A processor tells its controller without undue delay, or within its contract's hours.
Requests on a clock
A data subject's request runs on its one month, and the answer is kept on the record.
Erasure everywhere
An erasure reaches every table, and the record of checks still verifies afterwards.
For a business of 5 to 50 staff
FourWinds, who make Eurus, work hands-on with Irish businesses of 5 to 50 staff, and wrote a guide to this law for them.
Start here
See it on a business of your own.
Open your own copy in a few seconds and use it for two hours, with nothing to sign up for. When you want it on your own systems, we start with an audit.