Are you ready for the General Data Protection Regulation? VILT has compiled this Frequently Asked Questions document. Read about what it is and how we can help.

1. 1
frequently asked questions
GENERAL DATA
PROTECTION
REGULATION
Are you Ready?
changing ways together

2. Are you ready to GDPR?
Read about what it is and
how we can help.
Thanks for downloading this conpendium about GDPR, compiled
by VILT. We recommend you to take a few minutes to read it
carefully. Feel free to come back to us if you want to know more.
Page 3
1 • What is GDPR?
2 • Who is Affected by the GDPR?
3 • What happens if an organization
doesn’t comply?
Page 4
4 • What data should I take into
consideration?
5 • What is considered Personal Data?
6 • What is considered Sensitive Data?
7 • What are the requirements of the
GDPR regarding the protection of
personal data?
Page 5
8 • Article 5. of the GDPR
Page 6
9 • My organization resides outside the
EU. Does GDPR apply?
Page 7
10 • Which authority will audit my
organization and what is the scope of
application?
Page 8
11 • My organization is in the UK. How
does Brexit affect this?
12 • What measures can my organization
take to meet GDPR requirements?
13 • Will I need to change my
information systems in order to be
GDPR compliant?
Page 9
14 • What Solutions are there on the
Market that can help my Organization
support the GDPR in a fast, efficient and
transparent manner?
15 • What exactly is EIM and how can
their solutions help my organization?
Page 10
16 • Solution: VILT
FAQ answered

3. 3GDPR
FAQ
2
Who is Affected
by the GDPR?
The GDPR has a broad territorial scope.
It applies not only to all organizations
established in the EU that process
personal data, but also to any non-EU
established organization that process
personal data of individuals who are in
the EU in order to: a. offer them goods
or services, irrespective of whether a
payment is required; b. monitor their
behavior within the EU.
The GDPR’s aim is to protect personal
data at all stages of data processing.
The GDPR identifies two different
entities that both have obligations: data
controllers and data processors.
1
What is GDPR?
The GDPR is the new sweeping
European Union (EU) legislation that
modernizes and reforms the laws
that address the handling of personal
data. It replaces the European Data
Protection Directive (95/46/EC) which
was implemented inconsistently across
Europe and did not have legislative
authority.
3
What happens if
an organization
doesn’t comply?
• The framers recognize that current
EU data protection penalties are too
small and inconsistently applied.
• The GDPR specifies that fines
should be “effective” and “dissuasive”
- i.e., meant to inflict pain and to
discourage repeat offenses.
Two categories of fines:
• Level 1 = €10 million or 2% of global
turnover.
• Level 2 = €20 million or 4% of global
turnover.
In addition, individuals and privacy
advocates may file civil suits, and
executives may be jailed.

4. GDPR
FAQ
4
4
5
6
What data should I take into consideration?
Personal Data and Sensitive data should be taken into consideration.
What is
considered
Personal Data?
Personal Data is any information relating
to an identified or identifiable natural
person (‘data subject’); such as a name,
an identification number, location data,
an online identifier, or factors specific
to the physical, physiological, genetic,
mental, economic, cultural or social
identity of that person.
Organizations should take measures
to minimize the amount of personally
identifiable information they store,
and ensure that they do not store any
information for longer than necessary.
What is
considered
Sensitive Data?
Sensitive data is a special sub-category
of personal data which enjoys extra
consideration and protection in
GDPR as they may give rise to strong
stigmatization or discrimination in a
society.
Sensitive data are personal data that
reveal any racial or ethnic origin,
financial status, political opinion,
philosophical belief, religion, trade-
union membership, sexual orientation,
or concerns health and sex life, genetic
data, or biometric data.
The GDPR requires companies to
implement reasonable data protection
measures to protect consumers’
personal data and privacy against
data loss or exposure. Article 5. of the
GDPR summarises the most important
principles and requirements regarding
the management of personal data:
What are the
requirements
of the GDPR
regarding the
protection of
personal data?
7

5. 5GDPR
FAQ
8
Article 5.
of the GDPR
Lawfulness: fairness and transparency: personal data
should be processed lawfully, fairly and in a transparent
manner.
Limited purpose: personal data should be collected for
specified, explicit and legitimate purposes and not further
processed in a manner that is incompatible with those
purposes.
Data minimisation: personal data should be adequate,
relevant and limited to what is necessary in relation to the
purposes for which they are collected
Accuracy: personal data stored and managed should be
accurate and, where necessary, kept up to date.
Storage limitation: personal data should be kept in a form
which permits the identification of data subjects for no
longer than is necessary for the purposes for which the
personal data are processed.
Confidentiality and integrity: personal data should
be processed in a manner that ensures appropriate
security of the personal data, including protection
against unauthorised or unlawful processing and against
accidental loss, destruction or damage, using appropriate
technical or organisational measures.
Consent: Under the GDPR, consent requirements are
more precise: the request for consent must be presented
in a clear and unambiguous language (which excludes in
particular privacy policies presented in lowercase letters),
so that the person is able to give a free, specific and
informed consent. Consent must be explicit, rather than
implicit. Silence, pre-ticked boxes, or inactivity may thus
not constitute valid consent.
summarize

6. 6
9
My organization
resides outside
the EU. Does
GDPR apply?
The GDPR is “extraterritorial.”
It does not apply to a specific
geography, e.g. EU states, rather, it
applies to any company, located
anywhere in the world, that has
anything to do with EU residents
specifically.
Companies must comply with the
GDPR if any of the following apply:
• They are located in the EU
• They “offer goods or services” to EU
residents
• They “monitor” EU residents.
(For example, a company that tracks
browsing with a cookie may never offer
goods or services, but they are “monitoring”
EU residents And must comply with
regulation.)
Which
authority
will audit my
organization
and what is
the scope of
application?
GDPR
FAQ

7. 7GDPR
FAQ
10Which authority will audit my organization
and what is the scope of application?
The GDPR will expand its territorial reach and apply to any data controller or processor offering goods or services to
data subjects located in the EU, as well as to any processing relating to monitoring of data subjects’ behavior within
the EU. Data processors or subcontractors having an establishment located in the EU and processing personal data
for their activities will also be subject to the GDPR, bearing in mind that the concept of “establishment” has been
broadly interpreted by the Court of Justice of the European Union.
Where a controller or processor is not established in the EU, but is subject to the GDPR, the controller or processor
will generally need to designate an EU representative by written mandate. Companies without an EU presence
which offer goods or services to EU individuals or monitor their behavior should therefore get prepared to comply
with the GDPR.
The GDPR provides for a general personal data breach notification regime applicable to both data controllers
and data processors. Controllers must notify the competent DPO of a breach within 72 hours after the company’s
knowledge of the breach, unless such breach is unlikely to result in a risk to the rights and freedoms of individuals.
Affected data subjects must also be informed of the breach without undue delay, if the breach is likely to result in a
high risk to their rights and freedoms.
Processors must notify the controller without undue delay after becoming aware of a personal data breach.
From a practical standpoint, notifying a breach to the DPO within the required period (72 hours) may prove to be
quite challenging in terms of investigating regarding the nature and scope of the breach. Companies will need to
adopt internal procedures to handle such data breaches. Companies operating in the United States may be able
to use existing procedures used in the U.S. Further bear in mind that some local DPOs currently already require
companies to notify data breaches, such as the UK ICO for “serious” data breaches.
Data processors will have limited but direct obligations under the GDPR. This includes, for example, implementing
appropriate security measures and notifying controllers in the event of a data breach. A processor will be liable for
the damage caused by unlawful data processing only if it has not complied with the GDPR obligations which apply
directly to data processors or if the processor acted outside or contrary to lawful controller instructions.
Companies should review existing supply agreements to verify if they cover these new processor data obligations,
and if changes are needed who would bear the cost thereof.
Under the GDPR, only certain companies will be required to appoint a Data Protection Officer (“DPO”). The GDPR
requires a DPO where the core activities of the controller or processor consist of (i) processing, which by its nature,
scope, or purposes, requires regular and systematic monitoring of data subjects on a large scale, (ii) processing
special categories of personal data on a large scale, or (iii) if processing is carried out by a public authority. Member
States may also provide for stricter rules and require a DPO in other cases.
The DPO may be an employee or an outside provider; s/he will need to have expert knowledge. A group of
companies may appoint a single DPO to act for the group.
1 Scope of application
4. Breach notification
2 Data processor liability
3 Data protection officer
audit.

8. GDPR
FAQ
8
11
12
My organization is in the UK.
How does Brexit affect this?
If your company collects and stores the personal data of EU citizens, the GDPR
is relevant to your organization, even if you don’t have a formal presence in the
EU zone. In particular the UK, apart from the intention of leaving the EU, the
UK government
has demonstrated
adherence to the GDPR,
willing to implement
it in full force in order
to protect UK citizens’
personal data.
What measures can my
organization take to meet
GDPR requirements?
Ensure an
appropriate level of
security, including
confidentiality
Protect personal
information from
unauthorized access
Secure data
in transit
Provide right
to erasure
Provide right to
rectification
Provide right to
data portability
Adhere to data
minimization
Enforce records
management
Ensure data
protection by
design and default
13
Will I need to
change my
information
systems in order
to be GDPR
compliant?
There are no “one fits all” answer for
this question. It depends on the data
you hold on your organization, and
how you hold it. It’s important to
be aware that not only information
which is stored in some databases are
relevant here. You will need to take
care of:
• Structured data that you have on your
information systems, like ID numbers,
addresses, contacts, etc
• Unstructured data, that may also
contain personal data, like contracts,
invoices, emails, letters, etc
Both Structured and Unstructured data
may reside digitally or physically on your
organization, so you should also be cautions
about the physical archive you own.
However, there are several solutions that can
be set in place in order to handle this, for both
structured and unstructured data, digitally
and/or physically stored.

9. 9GDPR
FAQ
14What Solutions are there on
the Market that can help my
Organization support the GDPR in a
fast, efficient and transparent manner?
There are several EIM
(Enterprise Information
Management)
solutions that can
address your concerns.
Enterprise Information Management
is a set of methods and technologies
that help customers to maximize
the value of their information while
minimizing it’s risks.
What exactly is EIM
and how can their
solutions help my
organization?
15
ok.. but

10. 10
17
18
An important
first step will be
for organizations
to have clarity
on how they
manage personal
information,
including:
What personal data they process.
Where it is stored across the organization.
Who has access to it.
What consent has been provided and
where it is documented.
Where it is transferred from and to
(including to third parties and cross-
border).
How it is secured throughout its lifecycle.
If there are processes in place to dispose
of personal data, as per policy.
What Services
and Solutions
for GDPR
compliance
does VILT offer?
VILT can provide a broad set of services
and solutions that may help you on the
process of GDPR compliance, depending
on the state of the process you are. It may
include a data analysis in order to classify
the data you host and properly manage it,
which may include:
• Proposing a new EIM solution
• Upgrading an existing EIM platform
• Configuring or customizing your current
EIM solutions in order to enable the
control you need
In order to accomplish the following:
• Make sure that all the personal data
stored in the systems which is not
mandatory for business is erased.
• Create the mechanisms to monitor
the personal data to be stored in order
to be able to guarantee that only the
information which is necessary is stored,
for the minimal amount of time and
as well as to be able to manage all the
consents retained.
Some of the
solutions that
may come into
action are:
• Document Management
• Records Management
• Archiving
• Application decommissioning
• Cloud platforms
• Software as a Service
16
GDPR
FAQ

11. 11GDPR
FAQ
Organizations
need to act
now to ensure
that they are
ready to comply
with the new
Regulation when
enforcement
begins May 2018
www.vilt-group.com