Unpacking the GDPR

By now, most marketers are aware of the impending General Data Protection Regulation, a European Union initiative designed to give consumers greater control and transparency when it comes to the personal data companies are collecting and storing. The compliance deadline is May 25, 2018, which means any business that hasn't reviewed its policies and practices is running out of time.

Although the GDPR currently only applies to companies that possess data from EU residents, many experts believe similar regulations will start emerging elsewhere. It's best to prepare yourself and become compliant now, even if you don't currently have overseas customers.

About Global Documents

Global Documents provides you with documents from around the globe on a variety of topics for your enjoyment.

Global Documents utilizes edocr for all its document needs due to edocr's wonderful content features. Thousands of professionals and businesses around the globe publish marketing, sales, operations, customer service and financial documents making it easier for prospects and customers to find content.

Baker McKenzie LLP Data person Data Data subject Data Protection process policy inform privacy Purpose DPO

About Global Documents

Global Documents provides you with documents from around the globe on a variety of topics for your enjoyment.

Baker McKenzie LLP Data person Data Data subject Data Protection process policy inform privacy Purpose DPO

<p>Unpacking the European Commission 
General Data Protection Regulation
Getting into the Nitty Gritty of How to Comply
Lothar Determann | Partner, Palo Alto 
Julia Kaufmann | Partner, Munich 
Agenda
1
Project plan
4
2
Data mapping
6
3
Compliance recommendations
9
4
Implementation & ongoing review
29
 2017 Baker & McKenzie LLP
Speakers
3
Julia Kaufmann
Partner, Munich
+ 49 89 5 52 38 200
julia.kaufmann@bakermckenzie.com 
Lothar Determann
Partner, Palo Alto
+ 1 650 856 5533
lothar.determann@bakermckenzie.com
 2017 Baker & McKenzie LLP
EU general data protection regulation
4
What is it?
 Regulation v. Directive
 First major update since 1995
 What will happen to national law?
 When will it be effective?
 Does it apply to companies outside the EU?
 What are the major changes?
1
Project plan
 2017 Baker & McKenzie LLP
Project plan
6
Align core team (internal and external)
Establish GDPR project plan
Obtain senior leadership approval
2
Processing Records and 
Compliance Documentation 
 2017 Baker & McKenzie LLP
 2017 Baker & McKenzie LLP
Data mapping step-by-step
9
Scoping
- "staging the map"  prepare a 
project plan and the necessary tools 
and materials bespoke to your needs
- questionnaires/templates/guidance 
documents 
Information Collection
- via questionnaires/interviews collect 
all required information in order to 
generate a record of processing
- Consider internal and external 
resource required for this phase
Information Analysis & Mapping
- based on the information collected 
and your specific needs, produce 
data flow maps and analysis to best 
record and visualise your 
organization's data processing 
activities.
 2017 Baker & McKenzie LLP
Data mapping  the 5Ws of personal data
10
Who
 are we? are 
our data 
subjects? 
has access 
to personal 
data?
Where
 do we keep 
their 
personal 
data? do we 
transfer 
personal 
data to?
Why
 is personal 
data under 
our control?
When
 are we 
keeping 
personal 
data until? 
do we share 
personal 
data with 
others?
What
 mechanisms 
do we have 
in place to 
safeguard 
personal 
data?
3
Compliance recommendations
 2017 Baker & McKenzie LLP
13 Key GDPR compliance recommendations 
12
1. Prepare a record of processing activities
2. Establish a global data protection policy and governance
3. Confirm your cross-border data transfer solution
4. Update your global breach notification plan
5. Prepare HR-specific deliverables 
6. Prepare customer-specific deliverables 
7. Provide guidelines to information asset owners (PbD, PIA)
8. Update IT applications to address rights of data subjects 
9. Establish appropriate terms with data processors
10. Confirm suitable information security policies
11. Consider appointing DPO
12. Confirm game plan for one-stop-shop
13. Consider fines and consequences
 2017 Baker & McKenzie LLP
Prepare a record of processing activities
13
Obligation to maintain records of processing 
activities:

Identification of the controller(s)/ 
representative / processor/ DPO
 Purposes of the processing
 Description of the data subject and of the 
data processed
 Recipients
 Transfers
 Time limits for erasure
 Technical and organisational security 
measures
 2017 Baker & McKenzie LLP
Establish a Global Data Protection Policy
14
Develop Global Data 
Protection Policy ("Policy")
Policy establishes Global Data 
Protection Steering Committee 
(multi-disciplinary)
Policy establishes core 
principles for the protection of 
personal data
Policy provides for the 
appointment of privacy 
champions, data protection 
officers, and other features
Policy serves as 
foundational document for 
other subordinate 
procedures
 2017 Baker & McKenzie LLP
Confirm cross-border data transfer solution(s)
15
Privacy Shield
1
Standard contractual clauses (controller or processor)
2
Binding corporate rules
3
consent/other derogations, and potentially emerging codes of conduct, 
privacy seals, and others
4
 2017 Baker & McKenzie LLP
Update incident response policy
16
Personal data breach 
a breach of security leading to the accidental or unlawful destruction, 
loss, alteration, unauthorised disclosure of, or access to, personal data 
transmitted, stored or otherwise processed
"
"
not related to the quality / adequacy of the security measures
any incident impacting the c.i.a. trade (Confidentiality, Integrity, Availability)
 2017 Baker & McKenzie LLP
Update incident response policy (cont.)
17
DPA Notification
Nature of the breach
Within 72 hours of becoming aware of the 
breach
DPO identification
Consequences of the breach
Measures taken to remedy the breach
Can be done in steps
Data Subject Notification
No notification if data is 
encrypted, if technical 
measures have been taken or 
if notification involves 
disproportionate efforts
Notification without undue 
delay in case of high risk to the 
rights and freedom of 
individuals
 2017 Baker & McKenzie LLP
Prepare HR-specific deliverables
18
Employee Computer 
Use Policy
Procedures for Managers
Other HR deliverables
Employee Notice
 Cover robust content requirements and consider consent issues
 Notification and consent as needed for computer use monitoring
 Respond to access requests and other data subject rights
 Updates to Codes of Conduct, Hotlines, Works Council Agreements,
local notices/procedures, other documents
 2017 Baker & McKenzie LLP
Notice to data subjects (content)
19

Identity of the controller
 Purposes
 Obligation to respond to 
data subject
 Right of access, 
rectification and 
objection
 Recipients
 Transferts
Directive

Identity of the controller and of the 
DPO.
 Purpose
 Conservation period
 Right of access, rectification, 
restriction and objection
 Right to lodge a complaint
 Recipients
 Transfers
 Right to withdraw consent at any 
time
 Legitimate interest of the controller 
or of a third party (if relevant).

Information about profiling
 Any other information guaranteeing 
the loyalty of the processing
 
GDPR
 2017 Baker & McKenzie LLP
Prepare customer specific deliverables
20
Privacy Statement
Procedures for Managers
Other customer 
deliverables
Customer terms
 Corporate customer standard terms and playbook for contracting
 Customer-facing privacy statement(s) for websites, mobile apps,
and other sites and features
 Direct marketing procedures, data sharing rules, rules on responding
to access requests/rights of data subjects
 Statements for information collection points, consent terms, contracts
for onward transfers to business partners 
 2017 Baker & McKenzie LLP
Determine if consent (ever) needed
21
 New definition of consent requiring a clear affirmative action
 New conditions for consent to be valid
 New guidance regarding "freely given" consent
 New circumstances where explicit consent is required
 Local variations for minors' consent
Consent is grounds for processing (Article 6(1)), BUT:
 2017 Baker & McKenzie LLP
Provide guidelines for information asset owners
22
 Processing activities have to be planned, designed and 
performed with data security and, more generally, 
compliance with the GDPR in mind
Privacy by design
 By default, only personal data which are necessary for each 
specific purpose of the processing shall be processed
 By default personal data are not made accessible without 
the individual's intervention to an indefinite number of 
individuals
Privacy by default
 2017 Baker & McKenzie LLP
Guidelines for information asset owners (cont.)
23
No personal data are collected
beyond the minimum 
necessary for each specific 
purpose of the processing
No personal data are retained
beyond the minimum 
necessary for each specific 
purpose of the processing
No personal data are 
processed for purposes other 
than the purposes for which 
they were collected
Elements of privacy by design and privacy by default
No personal data are 
disseminated to non-public 
third parties for purposes other 
than the purposes for which 
they were collected
No personal data are sold
No personal data are retained 
in unencrypted form






 2017 Baker & McKenzie LLP
Guidance to information asset owners (cont.)
24
Impact assessment (art. 35)
 A description of the processing 
 An assessment of the necessity and proportionality of the processing 
operations in relation to the purposes

Involvement of the Data protection officer (DPO) where one is designated
 Requires consultation with the Supervisory Authority (SA) if controller does 
not mitigate the high risk
Privacy Impact Assessment (PIA) is mandatory when the 
processing is likely to result in a high risk for the rights 
and freedom of individuals. It should include: 
 2017 Baker & McKenzie LLP
Upgrade IT applications to conform to 
performance standards for data subject rights
25
 Logging of sources of personal data, and internal and external access
 Features to execute on data subject rights of access, correction, 
objection, profiling, data portability, and deletion (forgotten)
 Functionality that facilitates the secure destruction of personal data 
when no longer required for legitimate business and compliance 
purposes, in accordance with record retention policies
 2017 Baker & McKenzie LLP
Address requirements for data processors
26
Controller must establish a contract that covers:
 Description of subject-matter and duration of the processing
 Description of nature and purpose of the processing
 Types of personal data and categories of data subjects
 Obligations and rights for Controller (responsibilities and audit rights)
Direct obligations on data processors, such as
 Commit personnel to data secrecy

Assist Controller to respond to data subject's rights
 Comply with security measures

Assist Controller with security breach and DPIAs
 Cooperate in case of audits, including inspections
 2017 Baker & McKenzie LLP
Consider whether required to appoint a data 
protection officer (DPO)
27

inform and advice data controller or processor as well as employees;
 monitor compliance with data protection laws;
 cooperate with and act as contact person for supervisory authorities.
DPO has inter alia the following tasks:
 2017 Baker & McKenzie LLP
DPO appointment (cont.)
28
 Private sector organizations will generally be required to appoint a DPO 
where they process sensitive data on a large scale or engage in regular 
and systematic monitoring of data subjects on a large scale. 
 Even if not mandatory DPO requirement, consider whether to voluntarily 
appoint a DPO as to discharge their GDPR compliance obligations.
 Data protection authority guidance on appointing a DPO. 
 2017 Baker & McKenzie LLP
Game plan for one-stop-shop (OSS)
29
Identify likely Concerned SA that your Lead SA will liaise with 
Build good relations with your Lead SA
Monitor your Lead SA closely for guidance and enforcement priorities 
Identify your main establishment 
1
2
3
4
Monitor communications from the EDPB and SAs on how the OSS with 
be interpreted and applied in practice
5
 2017 Baker & McKenzie LLP
Consider fines and consequences
30
 20M 
4% of total worldwide annual 
turnover of preceding 
financial year
Example
Infringement of basic principles for 
processing, data subjects' rights, or 
obligations pursuant to Member State 
laws adopted under the GDPR
 10M 
2% of total worldwide annual 
turnover of preceding 
financial year
Example
Infringement of obligations regarding 
data protection by design or by default
4
Implementation & ongoing review
 2017 Baker & McKenzie LLP
Implementation (snapshot)
32
Establish 
implementation step list 
Set realistic timelines 
and assign sufficient 
resources
Keep senior 
management apprised 
of progress
Assess relative priority of 
compliance recommendations, 
and make strategic decisions
Continue with ongoing review 
and improvements to the data 
protection program
 2017 Baker & McKenzie LLP
End game: Actual demonstrated compliance
33
Policies & measures
Policies 
Procedures 
Measures
Record of 
all the 
processing
Information Policies
 Significant number of items to 
be provided

In an intelligible form
 May be done electronically
Training
Suitable Risks Analysis
Privacy Impact Assessments
Privacy by Design
Privacy by Default
Appropriate 
safeguards 
for cross-
border 
transfers
Well-
Functioning 
Governance 
Structures
Notification of 
Personal Data 
Breaches
 2017 Baker & McKenzie LLP
Questions?
34
Baker McKenzie Resources
Julia 
Kaufmann
Partner, Munich
+ 49 89 5 52 38 200
julia.kaufmann@
bakermckenzie.com 
Lothar 
Determann
Partner, Palo Alto
+ 1 650 856 5533
lothar.determann@
bakermckenzie.com
</p>