System Procedures

Figures involved in privacy procedures

The procedures of the privacy system regulate the behavior that the entire organization must have through all the figures involved that refer to the processing of personal data. They are:

• The data controller
• The DPO (Data protection officer)
• The system administrator (Figure provided by the Guarantor through a provision)
• The internal authorized persons of the organization (organization personnel)
• The external data processing managers (e.g. Accountant, Labor Consultant, Competent Doctor, etc.)
• Any joint data controllers in the processing

Processes governed by privacy procedure

The name used for the individual procedures of the privacy system allows for a clear understanding of the related regulated process

From reading the ordered sequence of procedures, it is clear that the organization cyclically provides for:

Examining and planning the security of its data subjects to respond to the changing context in which rules, risks, technologies, needs and rights change with the following procedures:

• PRO-01 Initial privacy analysis
• PRO-02 Privacy security assessments
• PRO-03 Privacy planning

Implement measures capable of managing, in relation to the context, the personnel who must operate on the personal data of others, the security measures that must protect the data, the rights and needs of the data subjects with the following procedures:

• PRO-04 Management of privacy personnel
• PRO-05 Management of privacy security measures
• PRO-06 Management of data subjects

Carry out activities to verify compliance with the GDPR and the actual effectiveness of the measures intended to protect personal data and the data subjects, and then intervene, with the procedure:

• PRO-07 Measurement, analysis and improvement

The processes governed by the privacy procedures

In order to highlight compliance and facilitate regulatory guidance of what is provided for by the system, each procedure of the GDPR PRIVACY PRO Kit contains a specific schematic section “Regulatory References” which refers the contents regulated by the procedure to:

• The specific articles of the GDPR
• The “whereas” of the GDPR, in relation to which the contents of the procedure are developed

This section contains the downloadable examples of the Procedures