The protection of personal data is a Fundamental Right , and therefore, self-employed persons have the obligation to guarantee this right. The GDPR for self-employed persons expressly states: “ all companies, societies, self-employed persons, communities, associations and public administrations of the Member States ”
The GDPR applies throughout the European Union and therefore to all companies whatsapp australia contact number that, being from outside the EU, offer goods or services to people or control their behaviour within the EU. That is, if you are a self-employed person from a country that does not belong to the EU, but you offer services or goods to an EU country, you must comply with data protection .
First of all, you need to know that depending on the data and information you collect, you will have different levels of security:
Basic level : refers to data such as name, surname, telephone number, address, email, etc.
Medium level : Includes data such as adcministrative violations, solvency, credits, etc.
High level : refers to specially protected data, such as ideology, sexual orientation, race, religion, etc.
Once you know what level of security your data must have, you must comply with the following obligations :
In order to collect and process the personal data of the interested party, their EXPRESS consent must be obtained.
Inform the interested party about who processes their data, why and how the processing will be carried out.
Analyze the risk
Draw up a Security Document and keep a Record of Processing Activities that records the security measures that have been implemented in the company.
In case of any incident or security breach, have a protocol
Conduct internal reviews to improve security
If interested parties exercise their rights, respond to their requests.
Draft and publish legal notices, privacy policies, cookies and information on websites.
If video surveillance systems exist, have informative signs and documentation relating to them.
Employees must sign confidentiality clauses and agreements not to disclose information.
Cooperate with both the Data Protection Agency and regional agencies.
If the data you manage is of a medium or high level of protection, it is mandatory that you carry out an audit every two years .
It is advisable that companies adapting to the LOPD be advised by experts in the field, since failure to comply with any of these obligations entails significant fines for the company or self-employed person.