Question library
Data protection questions and answers
Each question has its own page and an answer written the way we would explain it over the phone. This is general information, not individual legal advice.
Register and documents
- Do we need a record of processing activities, and where do we start?
- Is a website privacy policy legally required?
- Who in the company can see employee data?
- How do we appoint an employee responsible for data protection, and what goes into their duties?
- How do we write a privacy notice for our employees?
- How do we write rules for employees' use of work e-mail, computers and phones?
- How does a small company describe its technical and organisational security measures?
- Is GDPR training for staff mandatory, and how do we run and document it?
- May we publish an employee's photo on our website and social media?
- We are posting a job ad – how do we handle candidates' data correctly from start to finish?
Retention periods
Supplier contracts
Video surveillance
Impact assessment (DPIA)
- When is a data protection impact assessment (DPIA) required?
- How do you carry out a legitimate interest balancing test, and why does it need to be written down?
- How do we carry out a data protection impact assessment step by step?
- We run a dental clinic – what do we need to put in order under the GDPR?
- We run a sports club – what data protection work do we need to put in order?
Breaches and the State Data Protection Inspectorate
- What should you do when a personal data breach happens?
- How do you respond to an inquiry from the State Data Protection Inspectorate?
- We sent data to the wrong person — do we need to report it?
- How do we keep a register of personal data breaches?
- How do we tell people about a personal data breach, and what goes in the letter?
Marketing and consent
Data transfers
Articles
For when one answer isn't enough: structured pieces with examples and a method.
This text is general information and does not replace individual legal advice. If your situation is complex, it is worth discussing it with a lawyer.