Data Protection

Version: 1.0 | Effective from: 1 January 2026

1. Purpose

This directive defines the rules for processing personal data in compliance with the GDPR (EU 2016/679) and applicable national data protection legislation.

2. Core Principles

Principle	Description	Implementation
Lawfulness	Have a legal basis	Legal basis check before processing
Purpose limitation	Only for a defined purpose	Purpose documentation in ROPA
Minimization	Only necessary data	Data audit, deletion of unnecessary data
Accuracy	Data must be correct	Validation, updates, corrections
Storage limitation	No longer than necessary	Retention policy, auto-delete
Integrity	Data security	Encryption, access control
Accountability	Demonstrate compliance	Documentation, audit trail

3. Legal Bases for Processing

3.1 Overview of legal bases

Legal basis	When to use	Example
Consent	Voluntary, specific, informed	Marketing, cookies
Contract	Necessary for contract performance	Product delivery
Legal obligation	Required by law	Taxes, accounting
Legitimate interest	Your interest > data subject’s rights	Fraud prevention
Vital interest	Protection of life	Medical emergency
Public task	Exercise of public authority	Government administration

Valid consent must be:

Freely given — without coercion, not a condition of service
Specific — for a clearly defined purpose
Informed — the data subject knows what they are consenting to
Unambiguous — active action, not a pre-ticked checkbox
Withdrawable — at any time, as easily as it was given

3.3 Legitimate interest — LIA

Before using legitimate interest, conduct a Legitimate Interest Assessment:

Purpose test: What is the legitimate interest?
Necessity test: Is the processing necessary?
Balancing test: Does the interest outweigh the data subject’s rights?

4. Data Subject Rights (DSAR)

4.1 Overview of rights

Right	Article	SLA	Description
Information	Art. 13/14	At collection	What we process
Access	Art. 15	30 days	Copy of data
Rectification	Art. 16	30 days	Correction of errors
Erasure	Art. 17	30 days	Deletion of data
Restriction	Art. 18	30 days	Suspension of processing
Portability	Art. 20	30 days	Data export
Objection	Art. 21	30 days	Objection to processing
Automated decision-making	Art. 22	30 days	Human review

4.2 DSAR Workflow

5. Data Breach Management

5.1 Breach definition

Type	Example	Is it a breach?
Confidentiality	Data leaked to a third party	Yes
Integrity	Data was modified	Yes
Availability	Data lost without backup	Yes
Encrypted data stolen	Attacker has encrypted data	Depends on context

5.2 Notification Timeline

5.3 When not to notify the DPA

Data was encrypted and the key was not compromised
The breach is unlikely to impact the rights of data subjects
Document the decision!

6. Vendor Management (DPA)

6.1 Before vendor onboarding

Due diligence (security questionnaire)
DPA (Data Processing Agreement)
Sub-processor list
Data location (EU preferred)

6.2 Required DPA content

Item	Description
Subject of processing	What the vendor processes
Duration of processing	How long
Nature and purpose	Why
Types of data	What data
Categories of data subjects	About whom
Rights and obligations	Controller vs. Processor
Sub-processors	List + approval process
Security measures	Technical + organizational
Breach notification	Reporting SLA
Audit rights	Right to audit
Deletion	After contract termination

7. Privacy by Design

7.1 Principles

Principle	Implementation
Proactive	Privacy from the start, not retroactively
Default	Privacy as default setting
Embedded	Part of the architecture
Full functionality	Privacy + functionality
End-to-end	Entire lifecycle
Visibility	Transparency
User-centric	Respect for data subjects

7.2 New project checklist

Data minimization: Are we collecting only necessary data?
Purpose limitation: Do we have a clear purpose?
Legal basis: What is the legal basis?
Retention: How long do we retain?
Security: Encryption, access control?
Third parties: Who has access?
Subject rights: How do we handle DSARs?

8. DPIA (Data Protection Impact Assessment)

8.1 When a DPIA is required

Automated decision-making with legal effects
Large-scale processing of special category data
Systematic monitoring of public spaces
New technologies with high risk
Profiling with significant effects

8.2 DPIA Process

Description of processing — What, why, how
Necessity assessment — Is it necessary?
Risk identification — What risks?
Risk mitigation — How to minimize?
DPO consultation — Review
Approval — Sign-off
DPA consultation — If high residual risk

9. Retention & Deletion

9.1 Retention Schedule

Data category	Retention	Basis
Customer data	Duration of contract + 3 years	Business need
Employee data	Duration of employment + 10 years	Legal requirement
Financial records	10 years	Accounting regulations
Marketing data	Until consent withdrawal	Consent
Log data	1 year	Security
Backup data	30 days after deletion	Technical

9.2 Deletion Process

10. Training & Awareness

Role	Training	Frequency
All employees	GDPR basics	Annually
Customer support	DSAR handling	Semi-annually
Engineering	Privacy by design	Semi-annually
Marketing	Consent, direct marketing	Annually
HR	Employee data	Annually

11. Policy Review

Quarterly: Review DSAR log, incidents
Semi-annually: Update per regulatory guidance
Annually: Full policy review + DPO approval

Next review: Q2 2026