Privacy by design

Today, data is an integral part of every project. Whether you are creating a website, building a marketing campaign or implementing a new HR tool, it always involves processing data.

Any time you process personal data, the issues of privacy, protecting personal data, and the GDPR arise.

Just as you establish a functional and technical framework before diving into a project, it is essential to determine how the personal data to be processed will be protected –before the actual project begins.

This approach, called Privacy by Design, ensures that at their inception, projects are designed taking the issue of personal data into consideration. If you start by designing and launching a project, and then tack on a layer of GDPR at the end, the result will be at best inefficient, and potentially risky. To ensure optimum protection of the rights and freedoms of data subjects, projects should be compliant by default.

Whenever data processing is involved, you should include your Data Protection Officer in the project design phase — especially if the project includes high-risk processing such as data transfers. The DPO’s input will be key to the success of your project.

To reap the full benefits of your DPO’s expertise and their connection to your national data protection authority, and to benefit from their active participation in project design, it is crucial to draw up an GDPR project sheet and determine the data that will be collected and processed.

The GDPR project sheet is a crucial tool for laying out the steps and corrective actions — identified with the project manager, data controllers, subcontractors and service providers — to ensure full compliance and integration, thus guaranteeing a Privacy by Design approach.