Public sector and government

What is the first step in getting your local government’s compliance program underway?

Appoint a DPO

Naming a DPO is one of the first obligations for local governments.

The Data Protection Officer is often in charge of the compliance of several municipalities. They are a professional expert in protecting the personal data of public organizations. They will know how to set up a compliance strategy suited to your town or department, and will share best practices with you.

Setting up a record of processing activities

All public organizations maintain a record that maps all processing activities. In this record, the local government must list all concerned personal data processing activities: public swimming pools, senior citizens homes, childcare centers, social housing landlords, schools, police departments, etc. To complete the processing in a few clicks, the Data Legal Drive GDPR software offers more than 120 preconfigured processing activities specially designed for local government.

Each government processing activity can be fully described with additional information and documentation: types of data, storage times, purposes, security measures, and persons or departments concerned.

To be guided through the process and facilitate formalities, a GDPR compliance software program will save you time and allow you to publish a complete and easily updatable record. In the event of a CNIL audit, you will simply need to export the documentation providing proof of the local government’s compliance.

Managing relations with data processors

Whether a data hosting provider or an IT company, all local governments work regularly with service providers and external partners. As a local government, within the terms of the GDPR, you play the role of Data Controller (DC). In this capacity, a local government is required to include the following in agreements they sign with their data processors:

• Specify the roles and responsibilities of each party
• Define the processor’s obligations
• Identify and protect data transfers outside the EU

Guarantee the confidentiality and security of constituent data

In a local government, the GDPR means legal, organizational and technological security.

Local governments are required to protect the processing of their data by ensuring that their IT systems are robust.

To do this, each local government must conduct an assessment of existing risks and develop and deploy an IT security policy, organized by priority level.

The Management Center (CDG) that supports the IT requirements of public service establishments make IT services available to town halls and federations of municipalities that are suited to their needs. In addition to providing IT hosting solutions, the CDG supports the GDPR compliance programs of local governments by providing them with specialized software published by the legal tech firm Data Legal Drive.

Protecting the personal data of constituents and users helps to limit the risks of local government in the event of a cyberattack. On the other hand, if IT breaches are found, the local government may be held liable. Implementation of an action plan dedicated to GDPR compliance will allow the local government to prevent certain cyber risks.

From design to global GDPR compliance

Other GDPR principles must also be taken into account to give a local government a global vision of its compliance strategy:

• The concept of impact assessment, also called accountability: the local government must assess the risks, measure them, control them and document them, justifying the actions conducted and options chosen
• The concept of privacy by design, i.e. data protection beginning with the design of a project, for example by choosing service providers that are GDPR-compliant, setting up automatic data deletion, following the principle of data minimization at collection, etc.

The GDPR can be hard to grasp without specialized legal expertise, and the DPO’s job is to advise local governments in performing processes such as impact assessments and privacy by design.