The document provides advice and answers questions about personal data and user rights. It defines personal data as any information that can directly or indirectly identify an individual, such as IP addresses, work patterns, tax data. Processing of personal data refers to any actions taken with the data from collection to deletion. Users have rights to be aware of and update what data is stored about them, how it is used, and for how long. The document recommends checking user needs, data flows, and setting up automated systems for user requests. It concludes with three recommendations: don't process data without consent, don't process more than needed, and don't ignore user requests about their personal data.

1. Inspirational Design
Tudor Stanciu
Digital2Law
BucharestJS meetup, 21.02.17

2. Inspirational Design2
Advice:
Check your user roadmaps step-by-step
Q: What is “personal data”?
Any info that can identify an individual directly / indirectly
i.e. dynamic IP address; work hours/working + rest pattern; tax data;

3. Inspirational Design3
Q: What is “processing” of personal data?
Any action between the moment personal data is collected &
the moment personal data is erased
Advice:
Check entry/exit points & the flow in-between

4. Inspirational Design4
Q: How to handle user rights on personal data?
Users have to be aware / easily be updated about what data on them you are
storing, why, for how long etc.
Advice:
Set-up a semi-automated procedure to process user requests

5. Inspirational Design5
My Three Don’ts
• Don’t process data without provable user consent
• Don’t process more data than you actually need
• Don’t ignore requests from users re. personal data
ts@digital2law.com