Below, we have provided a useful checklist to help any US organizations understand the data protection requirements in the GDPR when considering such expansion. We have provided an easy way to remember this checklist using the acronym ‘P.A.G.E.R.’ which simplifies the checklist into five subheadings covering processing, administration, governance, evaluation and response
P – Processing
To be able to understand the extent to which your organization is caught by the various rules set out in the GDPR; it is important to map out your use of personal data. Specifically:
Who are you collecting or using personal data on and do they have control over what you do with their data? (‘Data Subjects’)
What are you doing with the personal data? (‘Processing Activity’)
Why are you using the personal data? (‘Lawful Basis’)
Where are you storing or sharing your personal data? (‘Location/Recipients of Data’)
When do you think you will no longer need the personal data, if ever? (‘Retention’)
How are you keeping the personal data safe? (‘Security’)
After you have been able to map out your use of personal data, you will be in a better position to understand which rules will apply to your business should it expand to cover the EU and UK. Additionally, you will be able to identify any risks with proposed expansion or establishment as early as possible.
A – Administration
Next, you can consider whether your organization should register with the relevant authorities based on the extent to which you will be processing in the EU and UK. For example, you will need to register with the Information Commissioner’s Office (ICO) if, following your data mapping exercise, you determine you will meet any of the following criteria:
- Established in the UK
- Offering goods or services to UK data subjects
- Monitoring the behavior of UK data subjects
The ICO also provides a tool where you can check which fee needs to be paid as a registered organization (Registration self-assessment | ICO).
If you operate across multiple EU countries you may be able to nominate a ‘Lead Supervisory Authority’ in the EU country of your main establishment, more information can be found in the One Stop Shop Leaflet by the European Data Protection Board.
Additional to registration, there may be a requirement to appoint a Data Protection Officer (DPO), who is the designated contact to support the organization with GDPR compliance. For example, in Germany, you must appoint a DPO if you are a public authority, or your core activities involve large-scale systematic monitoring of individuals or processing of special categories of data. Germany also has a local data protection law which requires a DPO if you regularly employ 20 or more people who handle automated personal data processing.
Finally, you may need to consider keeping a register of your processing activities or a Record of Processing Activities (RoPA’). You are required by the GDPR to create and maintain a ROPA if your organization processes:
- Personal data regularly (not on occasion),
- Personal data on 250 or more data subjects,
- Special category personal data (data related to ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic, biometrics, health, sex life or sexual orientation),
- Personal data related to criminal convictions or offences,
- Personal data in a way that is likely to result in a risk to the rights and freedoms of data subjects.
Luckily, if you have completed the ‘Processing’ step of the checklist, you will already have the information needed to be populated into the RoPA.
G – Governance
Now that you have understood and documented your processing and set up all the administrative steps, it is important to create a framework of governance for your organization to support employees in complying with data protection requirements. You can do this by creating the necessary policies and procedures, including but not limited to:
- Data Protection Policy
- Data Retention Policy
- Appropriate Policy Document (if you are processing special categories of personal data or data related to criminal convictions or offences)
- Privacy Notices
- Breach Response Policy and Procedures
- Data Protection Impact Assessment Procedures
Once this has been created, adequately published and circulated, it is important to maintain a regular schedule of data protection training and awareness covering the requirements and responsibilities of all staff. Adequately trained staff can be evidence of a safeguard in place to protect personal data against unauthorized use and access. Therefore, you can bolster the baseline all staff training with bespoke role-specific training for those high-risk roles and functions for an extra layer of protection.
E – Evaluation
Once the foundations of data protection compliance have been built, it is important that this is regularly assessed for assurance that these foundations remain adequate to meet the requirements set in the GDPR. An audit schedule will support your organization in doing so, whereby regular checks are undertaken to ensure, for example:
- That the RoPA is up to date,
- Whether a certain function is experiencing a high number of data breaches,
- Adequate resource, tools and support are available for data subject requests,
- Data protection risks have been identified and undergoing treatment and mitigation.
R – Response
Once established in the chosen EU or UK market, it is important you stay alert and ready for any events that require quick response. If you experience a personal data breach, you are required to notify the relevant Supervisory Authority within 72 hours of discovery if it poses a risk to rights and freedoms and notify a data subject if it is a high risk.
Data subjects can also exercise various rights against an organization in relation to their data. Responding to these requests can be resource intensive, especially as under the GDPR, organizations are required to respond to requests within one calendar month. If you have appointed a DPO when completing the ‘Administration’ step, they will be helpful here to guide your organization in responding to a personal data breach or a data subject rights request.
