Data protection authorities of many EU member states have published draft lists of data processing activities that would trigger the need for a data protection impact assessment in that country. The European Data Protection Board weighed in on the drafts, you can find its opinions here. CNIL Publishes Guidance For Data Processors • GDPR Buzz October 25, 2017 CNIL publishes guidance for data processors News CNIL, data processors, guidance On 29 September 2017, the French Data Protection Authority (the CNIL) released a guide for data processors on implementing the obligations laid down in the GDPR. According to the CNIL, consent should therefore be used as a legal basis for processing employee personal data only in exceptional cases ( i.e., where giving or refusing consent entail no consequences for the employees). Nature of the data processed and the management of data falling under a special category (article 9 GDPR) Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject. 2. In September 2017, the French Data Protection Authority, the CNIL, published a guide for data processors, which lists the responsibilities and obligations of the processor under the General Data The Guidelines also state that processing operations lawfully implemented prior to May 25, 2018 (e.g., processing operations registered with the CNIL, exempt from registration or recorded in the register held by the DPO under the previous regime) do not require a DPIA within a period of 3 years from May 25, 2018, unless there has been a The guidance addresses the extended scope of the GDPR and the new and direct obligations data processors will have when the GDPR comes into force on May 25, 2018. The guidance elaborates a The CNIL also recommends that organizations implement the WP29's DPO guidance and entrust their DPO with the following tasks: prepare an inventory of processing activities, evaluate processing practices and set up relevant processes (e.g., audits, security incident notifications, and handling requests from individual), identify risks The Guide also clarifies that any organisation which processes personal data, either as a data controller or processor, as part of its activities regarding the French territory, regardless of whether the processing itself occurs in France, and if the processing activity concerns persons who reside in France may be subject to an audit by CNIL CNIL publishes DPO guidance. schedule Nov 16, 2021. queue Save This. France's data protection authority, the Commission nationale de l'informatique et des libertés, published a guide to support data protection officers. The guidance discusses the process and factors to be considered when hiring a DPO as well as what resources should be The guide includes guidance and criteria from the AEPD, the European Data Protection Committee and the European Data Protection Supervisor. The Netherlands' DPA, Autoriteit Persoonsgegevens, issued guidance on the responsibilities of and suggested practices for a data protection officer. In addition to covering assigned duties, the guidelines On September 29, 2017, the French data protection authority (the CNIL) published practical guidance on General Data P