Pro Rep

This should be the correct legal title of the organisation

This is the person primarily responsible for the privacy/data protection function in the organisation.

This is a second point of contact in case the person primarily responsible for privacy/data protection leaves the organisation or is unavailable for some reason.

This is relevant for the Article 30 record

If the data is not your organisation's data, your organisation is processing for someone else, and your organisation is a 'processor' in EU law. Otherwise you are a 'controller'. An organisation can be both a controller for its own data and a processor for another organisation. An obvious example of a 'processor' is a payroll service provider company. The data it is processing is not its own, it is data provided by its customer, the 'controller'.

State what processing it is that the organisation does for itself. Answers might be like “processing customer orders automatically, processing customer contact details by email, processing marketing information by mailshot, etc. The emphasis here is on the method of processing that your organisation does for itself.

Answers might be like “HR data, Marketing Data, Customer Financial Data, Customer Health Data, Contact Data, etc. The emphasis here is on the types of data your organisation is processing for itself.

State what processing it is that your organisation does for that other organisation. Answers might be like “processing payroll, processing marketing information by mailshot, etc. The emphasis here is on the method of processing that your organisation does for some other organisation.

Answers might be like “HR data, Marketing Data, Customer Financial Data, Customer Health Data, Contact Data, etc. The emphasis here is on the types of data your organisation is processing for some other organisation.

Answers might be like "employee health data for pension and sickness policy reasons", "biometric data for door entry systems", "sexual data for health screening purposes" etc.

Answers might be like “Customers", "Prospective Customers", "Suppliers", "Employees" etc.etc. Please note that we are only concerned with data relating to individuals in the EU.

Answers might be like “Japan, Car Manufacturers etc.”

Answers might be like "Privacy Shield, Standard contractual Clauses as approved by the EU Commission, EU commission approved jurisdictions etc.

You are given both choices by the GDPR. You can have information sent to us as your representative only, or you can have it sent to either your organisation or us. We recommend sending it only to us, as otherwise there may be confusion as to whether some communication was in fact sent.

Answers might be like “6 years for financial data, 2 years for marketing data, etc. This should based on your data retention practices.

Answers might be like “Firewall, Locked filing cabinets, Anti malware software, Restricted access to necessary personnel, etc.