Monthly Archives: September 2023

The GDPR has very clear measures for these cases. There are deadlines for informing the Data Protection Supervisor, who must inform the National Data Protection Commission within 72 hours of becoming aware that the data has been compromised. If the breach could significantly affect the data subject, it may be necessary to inform them.

All personal data collected by the organic units of the UPB are mandatory in the context of employment in the civil service.

Applicants who do not become students, either because they have not been accepted, because they give up before starting, or because the procedure runs out at the end of the application, have their personal data deleted at the end of the period needed to guarantee the claim deadlines, with the exception of billing data, if …

Continue reading “Applicants for CTESP, master’s degrees and other programmes (e.g. non-degree courses) ask what we do with their personal data if their application is not accepted. What should I say? “

Most of this data is needed to answer official surveys such as RAIDES. In order to do this, educational institutions keep this information for the duration of the student’s stay and for a further two years after their last enrolment.

The person responsible for informing and advising all actors on their obligations under the applicable legislation, monitoring compliance with the regulation or other EU or national data protection provisions, as well as with the organization’s privacy policy, providing advice on the matter and monitoring the implementation of the data protection impact assessment, as well as …

Continue reading “What is the role of the Data Protection Supervisor?”

For data processing to be lawful, personal data must be processed on the basis of the consent of the data subject concerned or on another legitimate basis provided for by law, either in this Regulation or in another act of Union or Member State law referred to in this Regulation, including the need to comply …

Continue reading “In what situations is it lawful to process personal data? “

It is the process whereby there is no longer a link between the data subject and the data. In simpler terms, it consists of removing, modifying or replacing individual characteristics with coded representations to ensure that personal data cannot be attributed to an identified or identifiable natural person.

This means that the personal data collected must be limited to what is necessary for the purposes for which it is processed.

These are all the operations carried out on the data entrusted by the data subject. Access to data is data processing. Keeping it on file, creating copies, consulting it, publicising it, etc. are also data processing.

This is the person to whom the personal data relates.