GDPR-Jeudi-EN-aspects-technologiques.pdf

Here is a summary of the document in English, highlighting only the key points:

GDPR Implementation

• Controllers must notify the supervisory authority within 72 hours of becoming aware of a personal data breach.
• Notification should include:
  • Nature of the breach
  • Approximate number of data subjects and records concerned
  • Contact details for more information
  • Measures taken or proposed to address the breach

Codes of Conduct and Certifications

• Encourages development of codes of conduct to contribute to proper application of Regulation.
• Codes should cover:
  • Fair and transparent processing
  • Legitimate interests pursued by controllers
  • Collection, pseudonymisation, and information provided to public and data subjects
  • Exercise of data subject rights
  • Notification of personal data breaches

Existing Architectures: Challenges

• Mapping entire information system, including services provided by subcontractors.
• Adding metadata for each piece of personal data.

New Regulation => New Architectures... Solution Proposal

• 360° view:
  • Register: consolidating personal data in a third-party system.
  • Centralization: creating a master record for each client/user.

Emergence of New Services

• Proxies and personal data applications A and B.

Conclusion

• GDPR implementation concerns almost all companies.
• Important challenges must be met to comply.
• Need for inventiveness to implement concepts that are often not formalized.