Proportionality dictates that data processing must be adequate, relevant, necessary, and not excessive relative to its declared purpose.
What constitutes the principle of proportionality under the implementing rules? Read More »
Personal data shall only be retained for as long as necessary for its declared purpose, legal claims, or legitimate business.
How long can personal data be legally retained under the rules? Read More »
Data sharing for commercial purposes requires a data sharing agreement establishing adequate safeguards and is subject to Commission review.
Controllers must implement data protection policies covering organizational, physical, and technical security measures tailored to the specific processing risks.
What must a personal information controller do regarding data protection policies? Read More »
Records must describe the processing system, purposes, data subjects, data flow, security measures, and accountable compliance officers.
What essential details must be included in the records of processing activities? Read More »
Policies must prevent mechanical file destruction, and workstations must be secured against natural disasters, power issues, and unauthorized access.
Agency heads must approve or disapprove off-site access requests within two business days, otherwise the request is automatically disapproved.
Government agency heads must limit approved off-site access to no more than 1,000 sensitive personal records at a single time.
Data subjects have the absolute right to actively object to their personal data being processed for automated processing or profiling.
The personal information controller permanently remains entirely accountable for personal data even when it is actively transferred to a third-party processor.
Who is accountable for personal information transferred to a third party for processing? Read More »
