What's a retention period for a processing activity?

Personal data cannot be kept indefinitely: a retention period must be determined according to the purpose for which the data was collected.

The idea being to store data "as long as necessary" and "as short as possible", taking into account national legal rules that may impose fixed periods, and then to delete or anonymize them.

What's a third-party?

A third party is anyone outside the business and the individual concerned who can access the personal data you’re responsible for. There are 2 types of third parties:

What's a Data Privacy Impact Assessment

A Data Privacy Impact Assessment must be carried out by a controller when certain conditions are met and in compliance with Article 35 of the GDPR. It provides the assurance that privacy is adequately addressed, that risky processings are acknowledged and that the controller knows how to mitigate those risks for data subjects.

What are the Foreign Intelligence Surveillance Act (FISA) and Cloud Act?

Foreign Intelligence Surveillance Act (FISA) and Cloud Act are U.S legislations obliging American cloud providers to provide upon request to U.S intelligence agencies and courts individuals' data that they store, control and manage in the United States or even remotely.

Become GDPR compliant in minutes!

Privacyboard helps you comply with GDPR easily so you can focus on what's really important for your business.