In May 2016, the European Union introduced the mandatory General Regulation Protection Regulation (GDPR) 2016/679 (General Privacy Protection Regulation). The new EU regulation sets out a number of new guidelines covering all organizations that administer or control the processing of personal data. The Regulation is effectively enforced after May 25, 2018, and the time to date has been given to companies and government agencies to put all the requirements into the single framework imposed by the GDPR.
Why is the regulation introduced?
In order to improve the management of the personal data of individuals
In order to improve the operation of personal data
In order to introduce technical and organizational measures for access to personal data and its overall management by the data subject
In order to implement the protection of human rights in compliance mechanisms in data processing technologies
For the purpose of designating data protection officers in data control and processing organizations
What is the deadline for implementation?
The deadline by which all had to implement the appropriate measures was: 25.05.2018
Are there penalties for non-compliance with the regulation?
Sanctions after 25 May 2018 shall be up to a maximum of EUR 20 000 000 or up to 4% of the organization's total annual turnover for the preceding financial year.
What do the widely used terms and abbreviations mean in this area?
Personal data - any information that may directly or indirectly identify an individual
GDPR - General Data Protection Regulation (GDPR) – General Privacy Protection Regulation - Descriptions in the previous paragraph of a normative document
DPO - Data Protection Officer – Data Protection Officer (DPOP) - a new role / function in some organizations to be responsible for internal data retention rules and compliance with the regulation
GAP Analysis - A report containing analysis and assessment of the current level of compliance of business processes with GDPR requirements
PDPC - Personal Data Protection Commission
What's new?
Increased territorial coverage
Slightly increased amounts of property sanctions
Principles of processing
Rights of individuals
Data Protection Officer
Consent for the processing of personal data
Records of processing activities
Impact assessment on data protection, etc.
Provides complete and up-to-date information on the legal framework of the new Privacy Protection Regulation as well as guidance on the development of all relevant documents. With his help, your employee can independently develop all the documents - procedures, policies, registers, etc. Your manual is offered in a basic and full version, the full version of which includes prepared specimens of the necessary documents as well as sample types documents.
Within this service, we provide you with an electronic document - GDPR Handbook. With it, you get complete and up-to-date information about the legal framework of the new Personal Data Protection Regulation, as well as detailed guidelines for the development of all documents related to it. With his help, your employee can independently develop the documents necessary for the implementation of GDPR in your organization - procedures, policies, registers, regulations, etc.
Close
After reviewing your activity and the necessary consultations with your specialists, we will prepare for you everything necessary for the implementation of GDPR - policies, registers, regulations and any other documents to introduce the requirements and keep current GDPR accountability in your organization. The service also includes training your employee to follow-up the necessary periodic activities related to the regulation after its deployment, and within one year to inform you of any regulatory changes that are relevant and require changes to your documentation procedure.
The main stages of the GDPR Service Implementation that we need to implement are:
Stage #1: Understand the basic requirements of the legislation
Stage #2: Analyze and assess the current level of compliance with GDPR (GAP analysis) and assess the need for a Data Protection Officer
Stage #3: Drafting rules and procedures to meet GDPR requirements
Stage #4: Assisting in the implementation of the rules and procedures
Specific analyzes and assessments are carried out in the field of:
Organization and accountability for the processing and use of personal data
Level of centralization of data protection
Data protection levels
The level of data coherence
Data management rights
Notification mechanisms for compromising data
Actions in international data transfers
Role and responsibilities of data protection
Overall level of compliance with GDPR
If we do not have an active GDPR implementation agreement and you have questions or concerns about a specific document, situation, activity, or case related to GDPR, we can provide you with professional consulting services in this area. The service is related to consultations on issues arising from all obligations of administrators and processors of personal data imputed by the Regulation. Examples of such cases are: a review of a confidentiality agreement sent to you by your counterparty; issues related to the practical exercise of the data subject's rights; an assessment of the need to appoint a Data Protection Officer; review of legal bases for processing of personal data and others.
Close
This is a service we provide in the form of professional consultations and legal representation regarding administrative procedures, inspections or complaints about your activity as a personal data administrator. The service includes the direct and complex engagement of our specialists on a case-by-case basis.
With this service, we may assist you fully in, or in connection with, complaints or complaints about your activity as a personal data administrator, including checks or allegations of unlawful processing of personal data. We can provide you with reasoned opinions, answers to inquiries, consultations and explanations in all cases concerning the implementation of the GDPR, as well as contacts with supervisors. In case of initiation of an inspection on behalf of the Personal Data
Close
This is a service we provide to you based on an annual subscription. Performed after the initial GDPR deployment. Instead, we take care of the periodic keeping of current GDPR documents, as well as changes in the basic procedures, registers, policies, etc., caused by regulatory changes or changes within your organization. Once a year, we also perform the statutory GDPR audit by preparing all related documents.
With GDPR Service Subscription Instead of you, we perform periodic monitoring of your work in accordance with GDPR requirements. Successful deployment and ongoing implementation of GDPR requirements under the Regulation is established by conducting a periodic internal audit of business processes related to the processing and administration of personal data. The audit is done at least once a year and is conducted on a sampling basis, tracking the entire life cycle of randomly selected personal data. Ensuring the successful maintenance of the requirements is the implementation of a procedure for constant monitoring and monitoring of the processes of personal data management. An annual audit program is being prepared, within which activities to analyze and evaluate the design and implementation of all activities and control mechanisms related to the implemented GDPR must be carried out.
Depending on the activity and structure of the organization, the planning of these periodic audits covers to some extent the following areas
Personal data - identification, confidentiality, owners, coverage
Nature and scope of activity - administrator, territorial units
Legal basis for the administration of personal data - volume, character
Transparency of the processing and administration process
Data protection level and accountability
Respect the rights of the owner of personal data
Data security level
Monitoring and reaction to breakthrough (leakage, change, deletion) of data
Practices in international data transfer outside the EU
Use subcontractors in administration
After your organization's assessment of the need to appoint a Data Protection Officer (DPO, DPO), if such a person is needed, we can offer it as an outsourcing service, ie. to perform this position for you (DPO outsourcing). The service is based on a monthly subscription, and we perform all of the DPL's duties for you, we are your contact person with the state authorities and all other structures for everything related to GDPR.
DPO Outsourcing: This service can be provided to you after your organization's assessment of the need for a Data Protection Officer (DPO, DPO). Such an assessment is made when preparing the GAP analysis at the stage of GDPR implementation. If such a person is needed in your organization, we can offer you the DDZ outsourcing service.
The following data controllers have the obligation to designate a Data Protection Officer:
Public Authority or Local Government Authority
Administrators who regularly, systematically and extensively monitor data subjects
Administrators who perform large-scale processing of special (sensitive) personal data
In other law cases
DPO Outsourcing means that we will perform this position for you (DPO outsourcing). The service is based on a monthly subscription, and we perform all of the DPL's duties for you, we are your contact person with the state authorities and all other structures for everything related to GDPR. The price offered in our offer for this service is base. Once GDPR requirements have been implemented in your organization, you will be able to accurately assess what this person's monthly engagements will be and then you can determine the exact cost of the outsourcing service.
Close
The time for verification and implementation of the process can be very different, depending on many factors - the level of the processes already in existence, the size of the organization, the number of positions and places where personal data are processed, the level of IT infrastructure, experts and others. In any case, however, even for small businesses, the development and deployment process of the GDPR will not be shorter than three months.
Why choose a partnership with BUSINESS SOFTWARE CONSULT?
We at Business Software Consult know your organization because we have been working with you for many years in various other areas. We can gladly take care of the full technological introduction of GDPR in your organization.
Close
| № | Name of the product/service | Price/ BGN, without VAT |
|---|---|---|
| 1 | GDPR Handbook (base option - no samples and standard documents) | 240.00 |
| 2 | GDPR Handbook (full version - with ready samples and standard documents) | 540.00 |
| 3 | GDPR Implementation | 1 560.00* |
| 4 | GDPR Consultations (the price is for one hour) | 120.00* |
| 5 | GDPR Request Assistance | In Cases * |
| 6 | GDPR Subscription (the price is for 1 year for each year after implementation)) | 480.00* |
| 7 | GDPR Subscription + Request Assistance (the price is for 1 year for each year after implementation) | 720.00* |
| 8 | DPO Outsourcing (the price is monthly, valid for periods after implementation) | 240.00* |