Who are we?

The acronym GDPR stands for “General Data Protection Regulation” (GDPR). The GDPR regulates the processing of EU citizens’ personal data and companies situated within the EU. 

The legal context is being adapted to keep pace with social and technologic changes (increased use of digital technology, development of e-commerce, etc.).

This new European regulation has been inspired by the French Data Protection Act of 1978 and strengthens citizens’ control of the use that can be made of their data.

It harmonises the rules applicable in Europe by providing a single legal framework for professionals. It allows them to develop their digital activities within the EU based on user trust.

GDPR is a European regulation, which means that, unlike a European directive, it applies with no need of a transposition. Therefore, GDPR applies directly to all entities established in the European Union. The text goes even further because it protects the personal data of all citizens of the European Union, regardless of the country where the entity that processes this data is established.

Whether you are a data controller or a data processor, your risk in case of non-compliance with GDPR is strong sanctions, in particular in case of lack of consent from individuals or violation of the principles of personal data management.

Your risk is the following:

• A fine of €20 million, or
• 4% of your company’s annual consolidated turnover

depending on what amount is the highest.

• Increasing your internal and external business partners’ trust
• Improve your commercial effectiveness
• Managing your business better
• Improve the security of your information assets 
• Reassure your customers
• Develop your business by creating new offers

Any organisation is likely to be affected by GDPR. Indeed, its wide scope does not make any distinction based on the size, the activity, the legal form or the country of establishment.

Therefore, GDP applies to any organisation, public or private, which processes personal data on its own behalf or on behalf of another party, as long as:

• it is established within the European Union, or
• its activity directly targets European Union residents.

A Data Protection Officer (DPO) is a person responsible for ensuring the protection of personal data processed by a company. As such, he or she must ensure that all personal data processed by the organisation is used in accordance with the applicable regulations.

The DPO must be familiar with all data security laws and practices. He or she must have technical and legal expertise in the field of personal data protection. The CNIL (French Supervisory Authority) also recommends that the DPO should have a good knowledge of the business sector, the internal organisation, in particular of all processing operations, information systems and security measures, both technical and organisational.

Any company, regardless of its type or size, which processes the personal data of EU residents or which is established within the EU must appoint a person in its organisation who is responsible for monitoring compliance with GDPR. This person is even designated to the Supervisory Authority. The main tasks of a Data Protection Officer are to:

• Develop and implement the organisation’s data protection and privacy policy
• Train and advise staff on the provisions of the Data Protection Act
• Identify and monitor the use of personal data, ensuring that data protection principles are respected
• Handle and respond to all requests for information, correction or deletion from data subjects to ensure that their data is properly protected

GDPR gives the DPO a key role in the company and the power to report to the highest level of the company’s hierarchy.

The role of the Data Protection Officer has been formally defined by the European Union under the GDPR. The appointment of a DPO is mandatory in the following cases:

• If you are a public body or public authority
• If your main activity requires to process data to enable regular and systematic large-scale monitoring of data subjects
• If your main activity requires to process sensitive data (such as data related to health, offences, philosophical, religious or political opinions, racial or ethnic origin) on a large scale

EU representative

International DPO

Outsourced DPO

GDP compliance softwar