Compliance documentation
Ten documents that prove a service follows the law: what each is for, who it addresses, who writes it and which event requires an update.
- 23 cards
- 3 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
A few cards from the deck
Compliance documentation: what is it?
Show the answer
The set of documents an organisation keeps or publishes to show an authority or a counterparty that it meets its legal obligations.
Following the law is not enough: the accountability principle requires being able to prove it. A dated, up-to-date document is that proof.
Who is a record of processing activities intended for?
- The organisation, which shows it to the authority on request
- All site visitors, who must be able to read it online
- The counterparty, who signs it with the controller
- The organisation's customers, in the general terms of sale
Show the answer
The organisation, which shows it to the authority on request
The record is an internal management tool, kept at the supervisory authority's disposal. What is published for visitors is the privacy policy.
The … principle requires the controller to be able to demonstrate GDPR compliance, by means of documents.
Show the answer
The accountability principle requires the controller to be able to demonstrate GDPR compliance, by means of documents.
This is the reason behind all this documentation: without written proof, a compliant organisation cannot show it to the authority.
Legal notices: what is it?
Show the answer
A page published for everyone that identifies the website's publisher, its publication director and its host.
It is updated when the publisher's identity or the host changes: switching host without an update makes the page wrong.
When does the GDPR require a data protection impact assessment before starting a processing activity?
- For any processing of personal data whatsoever
- When it is likely to result in a high risk to people
- Only after a data breach notified to the CNIL
- Only in organisations with over 250 employees
Show the answer
When it is likely to result in a high risk to people
The impact assessment targets high-risk processing (large-scale monitoring, sensitive data in bulk, profiling with significant effects) and is carried out before it starts. The 250-employee threshold concerns only an exemption from the record of processing.