The European Data Protection Board (EDPB) recently published new Guidelines to help businesses comply with their obligation to adopt a Data Protection by Design and by Default (DPbDD) approach when processing personal data. Article 25 GDPR requires controllers to implement appropriate technical and organisational measures and safeguards that provide effective implementation of the data protection principles, and protect data subjects’ rights, by design and by default.  Article 25 prescribes both design and default elements that…

The European Commission recently published its new draft Standard Contractual Clauses (SCCs) for international transfers of personal data to third parties located outside of the EEA. The new SCCs have been expected for some time in light of the coming into force of the GDPR. The existing set of SCCs were implemented under the former Data Protection Directive 95/46/EC and still referenced that regime. The delay was due to the European Commission reconciling the new…

The European Commission recently published draft Article 28 Standard Contractual Clauses for use between controllers and processors located within the European Union.  The draft Article 28 Clauses are distinct from, and  should not be confused with, the European Commission’s new draft Standard Contractual Clauses (SCCs) for data transfers out of the EEA.  The latter SCCs contain their own set of Article 28 clauses.…

On 7 September 2020, the European Data Protection Board (EDPB) issued draft guidelines on the concepts of controller and processor. The concepts play a crucial role in the application of the GDPR, as they determine who will be responsible for compliance with different data protection rules, and how data subjects can exercise their rights in practice. The concepts have not changed compared to the Data Protection Directive 95/46/EC (now repealed) and the general criteria for…