GDPR

Organizations that are defined as data processors, even if they are processing data on behalf of a data controller, are accountable for protecting that personal data. These organizations must report data breaches and will be penalized if they are found to be non-compliant

It is critical for organizations to demonstrate that they have consent to process a subject’s data. Subjects must give their consent freely, and any written declarations must use plain language that can be easily understood. The subject can withdraw consent at any time, at which point the company must be able to remove the subject’s data from all its systems. This rule is often referred to as “the right to be forgotten.” For children, data can only be processed with the consent of a parent or legal guardian. Data subjects are also entitled to make subject access requests to organizations that hold their data for free..