Protection of personal Data

Digital transformation and the personal data that goes with it

Lavoix’s team of lawyers can assist you in ensuring that your activities are compliant with personal data law and in particular with the GDPR.

Lavoix’s comprehensive support covers the following areas:

Audits of personal data processing
Website audits
Information notices and personal data collection forms
Maintaining the register of processing operations
Contracts
Privacy policy
Cookie policy
Binding corporate rules
Impact assessments
Staff awareness and training
CNIL (French data privacy regulator) disputes and court litigation

Lavoix’s team of lawyers can also assist you as an external DPO:

Role

Global project manager ensuring the effective implementation of your GDPR compliance plan
Professional skills in law and data protection

Tasks

Inform and advise
Oversee compliance with the GDPR
Cooperate with supervisory authorities

FAQ

What is the GDPR?

The General Data Protection Regulation (GDPR) came into force on May 25, 2018. It governs ‘the protection of individuals with regard to the processing of personal data and the free movement of such data’.

It applies to businesses and public authorities established in the European Union or outside the EU that offer goods/services to or monitor the behavior of individuals located in the EU.

The processing of this data is only lawful if it is based on at least one of the following legal grounds (Article 6 of the GDPR):

consent,
contract,
legal obligation,
safeguarding vital interests,
public interest,
legitimate interests.

What is personal data?

Personal data refers to “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person” (Art. 4.1 of the GDPR).

What are the principles relating to data protection?

Personal data must be processed according to 7 fundamental principles as defined in Article 5 of the GDPR:

Lawfulness, fairness, transparency
Purpose limitation
Data minimization
Accuracy
Storage limitation
Integrity and confidentiality
Accountability

What are the rights under the GDPR?

Every physical person has rights regarding their personal data:

Right to information and access to their data
Right to rectification: correction of inaccurate or incomplete data
Right to erasure: deletion of their data
Right to restriction of processing
Right to data portability (transfer of data to another data controller)
Right to object on legitimate grounds (profiling, prospecting, etc.)
Right to object to automated individual decision-making (automated data processing)

What obligations are governed by the GDPR?

A personal data controller must comply with several legal obligations:

Accountability: carry out compliance processing and document it
Informing the individual concerned
Maintaining a record of processing activities
Information security
Notification of breaches to the individual concerned and to the data protection authority of your country
Conducting an impact assessment
Appointing a Data Protection Officer (or DPO)
Performing secure transfers (any transfer outside the EU is prohibited)
Selecting processors that offer sufficient guarantees

These processors must also comply with obligations of transparency and traceability, security, and provide assistance, alerts, and advice.