GDPR

Last Updated: September 22, 2023

What Is Personal Data?

Any information relating to an identified or identifiable natural person ('data subject'). An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as name, email address or location, and also online identifiers like IP address, types of website cookies and other device identifiers.

For example: IP address of visitors at your site, location, your email address when you log into the Tagalys dashboard; CRM software collecting online identifiers to learn prospect activity from the company website or product.

Who Are Data Controllers, Processors and Sub-Processors?

A data controller is the entity or person that determines purposes and means of processing personal data of the EU resident. For example, Tagalys is a data processor and our customers (online retailers) are controllers of the EU resident's data.

The GDPR applies to both data controllers and processors. Controllers collect data from the end-user — the EU resident — for purposes clearly stated and with appropriate consent. Data processors provide services to the controller in accordance with each controller's instructions. Processors also use data collected to perform benchmarking analysis, so that they can sell further services allowing controllers to compare their data to industry averages.

Another category called sub-processors — third-party businesses performing data processing for other companies — are also accountable for protection of personal data, according to the GDPR.

Who Is a Data Protection Officer (DPO) and Does My Business Need One?

The DPO is responsible for informing employees of their compliance obligations as well as conducting monitoring, training, and audits required by the GDPR. A DPO needs to be appointed if you:

  • process large amounts of personal data
  • carry out large scale systematic monitoring of individuals, or
  • are a public sector authority

Can We Use Tagalys Before You Are Fully Compliant?

Yes, you can confidently continue with Tagalys as we are currently GDPR compliant. The regulation approved by the EU parliament in April 2016 provides businesses an adapting period of 2 years until the enforcement date of May 2018. Preparing for GDPR is a company-wide challenge involving a large amount of time, resources and expertise. Tagalys has been GDPR compliant as of May 23rd, 2018.

What Is the Cloud or SaaS Advantage to Meeting Data Governance Policies?

Meeting compliance requires investments in time, effort, cost and expertise. The solution lies in being part of a cloud or SaaS ecosystem that is already operating on a secure model for data management. This provides a safe environment to manage and process your data, and also accommodates the efforts required to keep pace with changing policies.

How Does My Business Benefit by Complying with the GDPR?

The GDPR helps restore consumer trust by acting as a central authority governing rules of data protection and rights across the EU. The new law allows businesses to undertake opportunities in the digital market while protecting an individual's fundamental rights.

Businesses can capitalise on opportunities through:

  • Cost savings and less complicated policy management by dealing with one law, not 28. This otherwise required expenses and efforts dealing with regulations for each member state locally.
  • Consistency in the practice of data protection measures both in and outside the EU, because the same regulation applies to all businesses regardless of where they are based.
  • The regulation enables innovation to flourish under the new law.

What Do You Mean by 'Right to Be Forgotten'?

Individuals have the right to have their personal data deleted in the event that it is no longer needed. 'Right to be forgotten' is in support of freedom of expression.

Does the GDPR Require EU Data to Stay in the EU?

No, the GDPR does not require EU personal data to stay in the EU, nor does it place any new restrictions on transfer of personal data outside the EU.

Data transfers from the EU to outside can be legitimised in many ways including:

  • EU-US Privacy Shield
  • Model or Contractual Clauses
  • Binding Corporate Rules (BCR)

What Does GDPR Mean by "Data Protection by Design and by Default"?

Data protection by design means ensuring only the personal data which is required is collected, and also incorporating privacy features and functionality into products and services from the time they are first designed.

Data protection by default means businesses must implement appropriate measures to mitigate privacy risks at the time of collection of the data, as well as by extending it at the time of processing it.