Processing data of European residents in full compliance
The General Data Protection Regulation applies as soon as an organization processes data of European Union residents - including a Beninese company with customers or users in Europe. It is one of the most demanding and best-documented data protection regimes in the world.
Six legal bases, never a tick box
Every processing operation must rest on one of the six legal bases provided for (consent, performance of a contract, legal obligation, vital interest, public interest task, legitimate interest) - and that basis must be identified and documented for each processing operation, not globally for the organization. Consent, often seen as the default solution, is in fact the hardest basis to keep valid over time (it can be withdrawn at any time, and proof of consent must be kept).
Impact assessment and Data Protection Officer
Processing that poses a high risk to individuals’ rights (large-scale profiling, sensitive data, systematic monitoring) requires a Data Protection Impact Assessment (DPIA) before it is implemented. Appointing a Data Protection Officer (DPO) is mandatory above certain activity thresholds, but remains good practice as soon as personal data processing is significant.
Breach notification: a 72-hour deadline
A data breach likely to result in a risk to the individuals concerned must be notified to the competent supervisory authority within 72 hours of becoming aware of it. Such a short deadline means being able to detect a breach quickly (logging, alerting) and having a response plan already prepared - improvising it at the time of the incident costs time you do not have.
Suggestion provided for educational purposes - human validation required. This guide does not constitute legal advice and does not replace an accredited external auditor.