You’ll learn how to: 

• Review the vendor’s data handling practices 
• Assess policies and procedures 
• Evaluate technical security measures 
• Review international data transfer controls and processes 
• Mitigate risks & finalise the Data Processor Agreement (DPA) 

Overview

According to a report by technavio, the global outsourcing market is expected to grow by $88.8 billion between 2024 and 2029, with a compound annual growth rate of 6.8%. 

Outsourcing specific processes, or even entire business functions, can enhance efficiency and allow companies to focus on their core strengths. However, when you have vendors handling personal data, it’s critical to understand the associated data protection responsibilities of both parties. 

Under the General Data Protection Regulation (GDPR), vendors include any third parties, partners, or suppliers with access to personal data – not just traditional service providers. 

Organizations are legally required to safeguard personal data, and failure to do so can result in fines and reputational harm. Ensuring that your vendors also meet GDPR obligations is a key part of maintaining compliance. 

Understanding GDPR roles: Controller vs processor 

The GDPR distinguishes between a data ‘controller’ and a ‘processor’ to clarify their respective roles and responsibilities in managing personal data. 

• A ‘controller’ decides how and why personal data is collected and processed 
• A ‘processor’ handles personal data on behalf of the controller, following on their instructions 

Data controllers hold the highest level of compliance responsibility, even if a third-party vendor is handling the day-to-day processing.  

Data processors have some direct legal obligations, including notifying the controller of any data breach, implementing appropriate data security measures, and keeping a record of data processing activities.  

Let’s look at a real-world example: 

A North American healthcare provider (controller) collects patient data from individuals in the EU to provide medical services. The data is stored and managed on a third-party cloud storage platform (provider) and includes information such as names, addresses, and medical histories.  

In this example, the healthcare provider must ensure any personal data is processed in strict accordance with the GDPR. This includes providing clear privacy notices, establishing an appropriate lawful basis, and safeguarding the security of the data, including any onward transfers of personal data outside the EU.  

Before using the third-party cloud storage platform, the healthcare provider must: 

• Ensure the vendor’s data protection practices meet GDPR standards 
• Identify and mitigate any risks before sharing personal data 
• Implement clear contracts that outline roles, responsibilities, and security requirements 

Once onboarded, the cloud storage platform must follow the healthcare company’s instructions and maintain robust safeguards. If a data breach occurs, the cloud storage provider is expected to notify the healthcare company without undue delay – ideally within 48 hours, though this should be determined in each contract.  

Reminder: Under the GDPR, controllers have up to 72 hours after becoming aware of a personal data breach to report it to the relevant regulatory authority. If the breach poses a high risk to individuals, they must also be informed directly.  

5 essential steps for effective due diligence

A best practice due diligence process typically starts with a questionnaire and follows these 5 key steps:  

Step 1: Review the vendor’s data handling practices

A due diligence questionnaire should request the vendor’s privacy policy and any voluntary or mandatory risk assessment documents, such as Data Protection Impact Assessments (DPIAs), relating to the services offered.  

Key details to establish: 

• How personal data will be collected 
• Where it will be stored 
• Who will have access to the data 
• Use of sub-processors, including their data handling practices (sub-processors are third parties engaged by the vendor who may access the personal data) 
• What the retention periods are (the GDPR requires data to be kept no longer than necessary) 
• If they have any certifications, such as Cyber Essentials Plus, ISO9001, or ISO27001/27701, which demonstrate a commitment to strong data protection practices across the organization 

Step 2: Assess policies and procedures

The next step is to evaluate the vendor’s data protection policies and procedures to ensure they align with GDPR requirements.  

These should include at least: 

• Privacy policy and privacy notice 
• Data breach response procedure 
• Data Subject Access Request (DSAR) procedure 
• Data sharing processes 
• Employee data protection training programs 

The vendor needs to demonstrate that appropriate controls are in place for data processing, including any sub-processors they may use, and that these controls are regularly audited and maintained.  

Step 3: Evaluate technical security measures

Ensure the vendor has robust technical safeguards to protect personal data from unauthorized access, alternation, disclosure, or destruction.  

These measures may include: 

• Encryption: Converts data into a code to prevent unauthorized access 
• Access controls: Authenticates users and restricts access to systems and data 
• Firewalls: Monitors and controls incoming and outgoing network traffic based on predetermined security rules 
• Intrusion detection systems (IDS): Detects malicious activity within the network 
• Security incident and event management (SIEM) systems: Analyses security alerts generated by applications and network hardware in real time 
• Regular security audits: Systemic evaluations of IT systems to measure how well they conform to a set of established criteria  

Step 4: Review international data transfer controls and processes 

If personal data is stored or processed outside the EEA and/or UK, the vendor must demonstrate that a valid international transfer mechanism is in place.  

Your contract should require the vendor to implement appropriate safeguards for both their own transfers and any onward transfer by sub-processors. This often involves using Standard Contractual Clauses (SCCs) or another GDPR-approved mechanism.  

If the data is considered high risk, a supporting DPIA should also be provided.  

International Data Transfers: Explaining EU SCCs, UK Addendum and UK IDTA | DPO Centre

Step 5: Mitigate risks & finalise the Data Processor Agreement (DPA) 

If any risks have been identified during the due diligence process, the vendor needs to resolve them before moving forward. For example, if the vendor lacks intrusion alerts, they should implement system monitoring and provide evidence.  

The final step is to draft a Data Processing Agreement (DPA), which should include: 

• General information – Purpose, duration, data categories, and GDPR responsibilities of both parties 
• Security measures – Technical and organizational safeguards required of the processor 
• Sub-processors – Whether sub-processing is allowed and under what conditions 
• Breach notifications – Requirement to notify the controller without undue delay in the event of a breach 
• Audits and inspections – Controller’s should secure the right to verify compliance through audits 
• End-of-contract provisions – Instructions on returning or deleting data at contract termination 
• Liabilities and indemnities – controllers should require processors to indemnify them against all costs, claims, damages, and expenses incurred because of their actions. Controllers typically seek unlimited liability, while processors should negotiate a cap. 

For a template DPA download our GDPR Policy Toolkit 

Summary

Conducting vendor due diligence is essential for identifying and mitigating risk and ensuring GDPR compliance. It provides an opportunity to evaluate a vendor’s operational procedures data protection practices before entering into a contract.  

An effective due diligence process should include a questionnaire covering five key areas: data handling practices, policies and procedures, technical security measures, international data transfers, and risk mitigation prior to drafting a Data Processing Agreement (DPA). 

These steps also apply to existing suppliers or outsourced services. However, given the number of suppliers most organizations work with, it’s often more practical to start with a pre-qualification risk assessment. This helps prioritize which vendors require further review based on factors like GDPR applicability, risk level, and the type of data processed. 

____________________________________________________________________________________________________________

The DPO Centre has extensive experience helping North American organizations meet their GDPR obligations when working with third-party vendors. Contact us today for expert support with your vendor due diligence processes. 

____________________________________________________________________________________________________________

In case you missed it… 

• Lead generation and the GDPR: A guide for North American businesses 
• Data retention strategies for GDPR compliance
• How GDPR territorial scope impacts North American businesses

____________________________________________________________________________________________________________

For more news and insights about data protection follow The DPO Centre on LinkedIn

The post 5 steps to GDPR-compliant vendor due diligence  appeared first on DPO Centre.

Since the General Data Protection Regulation (GDPR) came into effect in 2018, marketing strategies have undergone a significant transformation, with a definite shift toward inbound methodologies. Attracting engagement from customers, rather than pursuing prospects directly has become the modern standard. Outdated tactics such as buying prospect lists, cold calling, and sending unsolicited emails have been replaced by a focus on creating valuable, engaging content, and tailored experiences. 

For the purposes of our discussion, we consider the EU GDPR and the UK GDPR under the same umbrella, focussing on the common aspects for businesses operating in both or either the EU and the UK. There are specific differences and nuances in the legislations that are not covered here and may be applicable to your organization. For further advice, please speak to your Privacy Officer/Data Protection Officer. 

Establishing a lawful basis under the GDPR 

The General Data Protection Regulation (GDPR) provides the legal framework for the collection, processing, and storage of personal data of individuals in the EU (with the UK GDPR applying to individuals in the UK). 

North American organizations must establish an appropriate lawful basis for processing personal data of EU and UK individuals. This means that before collecting any personal data, you must first identify and document the lawful basis for doing so. 

There are six lawful bases under the GDPR:

Consent – where an individual has given consent for their personal data to be processed 

Legitimate Interests – where the processing of an individual’s personal data is necessary for the legitimate interests of a business or organization, unless there is a good reason to protect the individual’s personal data, which then overrides those legitimate interests 

Contract – where the processing is necessary for the performance of a contract a business or organization has with an individual 

Legal Obligation – where the processing is necessary for a business or organization to comply with the law 

Vital Interests – where the processing is necessary to protect someone’s life 

Public Task – where the processing is necessary for the performance of a task in the public interest or for official functions, and the task or function has a clear basis in the law 

After determining a lawful basis, you must document it and ensure the information is clearly stated in your privacy policy and privacy notice. 

Choosing the most appropriate lawful basis is essential, as it is difficult to change later without good reason. The lawful bases commonly used for processing personal data for marketing and lead generation purposes are consent and legitimate interests. For certain types of marketing activities, consent is the only appropriate lawful basis to use. A data privacy officer (DPO) can provide guidance on the most suitable lawful basis for your personal data processing. 

ePrivacy Directive and PECR

In addition to the GDPR, North American businesses undertaking digital marketing and lead generation activities in the EU and/or UK must also comply with regulations governing electronic communications, cookies, and tracking technologies. 

The EU’s ePrivacy Directive, often referred to as the ‘cookie law’, covers key areas related to electronic communications and privacy, including consent for cookies and marketing communications. 

The UK’s Privacy and Electronic Communications Regulations (PECR) sets out the rules and requirements for electronic communications and privacy within the UK. The legislation is the UK’s implementation of the EU’s ePrivacy Directive, and it sits alongside the UK GDPR. 

Privacy rules for electronic communications 

The ePrivacy Directive and PECR have specific standards that apply when processing the personal data of individuals in the EU and UK through electronic communications and other marketing tactics. 

You must: 

• Obtain consent before collecting an individual’s personal data 
• Provide clear and transparent information about how the personal data will be used
• Collect only the personal data that is necessary 
• Obtain consent before placing non-essential cookies on a user’s device  
• Provide an easy way to opt-out 

Understanding consent

Consent is a fundamental aspect of data privacy law. The GDPR defines consent as: 

any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her. – Article 4(11) 

In certain situations, or for specific processing activities, consent is the only lawful basis that can be used. 

Consent is also mandated by the ePrivacy Directive and PECR, where the use of cookies, tracking pixels, web beacons, and other similar technologies are used to collect personal data for online advertising and targeting. 

Consider this example: How CompanyX reaches potential customers

CompanyX wants to connect with website visitors who have not yet made a purchase. A tracking pixel from a social media provider is integrated onto their website. The pixel tracks users after they have left the site, allowing CompanyX to display targeted ads for their products when that user visits other websites. 

This strategy falls under the ePrivacy Directive and PECR and requires consent. Both use the definition of consent found within the GDPR (above). 

How to obtain consent

Under the GDPR, organizations must obtain explicit consent from customers before collecting their personal data. Lead generation tactics, such as pre-ticked boxes, implied consent, or bundling consent in with other actions, are no longer allowed. 

Here is a breakdown of the factors required for obtaining consent under the GDPR: 

Freely given: Consent must be given voluntarily, without coercion or manipulation. It should be a genuine choice for the individual, not forced. 

Specific: Consent must be tied to the exact purpose. Individuals should be informed what their personal data will be used for, and their agreement limited to that specific use. When processing has multiple purposes, consent must be obtained for all of them. 

Informed: Individuals must be given information about the processing of their personal data before giving consent. This includes knowing what data will be collected, who is collecting it, why, how long it will be kept, and any other relevant details. 

Unambiguous: Consent should be clear and easy to understand. 

Indication of wishes: Consent must be given through an affirmative action, including written, electronic, and oral statements. For example, a tick box on a website or a written consent form. Pre-ticked boxes or inactivity do not constitute consent. 

Withdrawable: Individuals who change their mind have the right to withdraw their consent at any time. The withdrawal process must be as easy as giving consent. 

How to collect, record and manage consent

In line with the GDPR’s accountability principle, which states that organizations must take responsibility for what they do with personal data, there is a requirement to evidence the process of obtaining consent.  

This means that in addition to securing permission from an individual to process their data, you also need to keep records and evidence the process. 

Let’s look at the critical aspects of consent management a little closer and the details you should document: 

Who consented: The name of the individual or other identifier (e.g. online username, session ID). 

When they consented: A dated document or online records with a timestamp. For oral consent, a note with the time and date of the conversation. 

What they were told at the time: A master copy of a document or data capture form containing their consent statement and a copy of the privacy notice or other privacy information, including version numbers and dates that match the date consent was given. For oral consent, your records should include a copy of the script used at that time. 

How they consented: A copy of the relevant document or data capture form. For online consent, your records should include the data submitted and a timestamp to link it to the relevant data capture form. For oral consent, the whole conversation does not need to be recorded, only a note of the time the conversation took place. 

Whether they have withdrawn consent: If so, when? 
 
Review and refresh the consent process if anything changes. It is recommended that you consider updating consent every two years. 

Relying on Legitimate Interests

The GDPR states that the processing of personal data for direct marketing purposes may be considered a valid reason or legitimate interest (GDPR Recital 47). However, as marketing is generally in the interests of the business, the validity of using legitimate interests as a lawful basis for processing data must be carefully considered, balancing any possible consequences for the individual.  

A Legitimate Interests Assessment (LIA) is a useful tool that can be used to identify and consider this lawful basis as a possible justification for processing personal data under the GDPR. 

An LIA is comprised of the following three-part tests: 

1. The purpose test (identify the legitimate interest)  
2. The necessity test (consider if the processing is necessary)  
3. The balancing test (consider the individual’s interests)  

Using legitimate interests as a lawful basis will only be permissible if it does not affect the fundamental rights and freedoms of individuals, which always take precedence. This means that while using legitimate interests as a lawful basis, the focus is not on preventing every negative outcome or consequence but on ensuring that any potential negative consequences are not excessive or out of proportion compared to the intended benefits or purposes. It’s about maintaining balance. 

Consider this example: How CompanyX delivers personalised ads 

When PersonA became a customer of CompanyX a year ago, they provided their email address for communication purposes. During the first communication, CompanyX informed PersonA of two key points: (i) their email address would be used to advertise similar CompanyX products on social media, and (ii) they had the right to object to this processing at any time. 

CompanyX then added PersonA’s email address to its customer database and shared it with a social media provider. This collaboration allowed CompanyX to match its list of customer email addresses with those held by the social media provider. As a result, CompanyX gained the ability to precisely target and market similar products to PersonA via their social media feed. 

This strategy falls under the GDPR and can rely on the lawful basis of legitimate interests. 

Working with lead generation providers

Lead generation companies use a variety of marketing strategies to provide qualified leads that can potentially be turned into customers. 

However, it is important to note that your data processing responsibilities remain and must be upheld, regardless of the use of a third-party service. 

The GDPR makes a distinction between organizations and third parties by using the terms ‘data controller’ and ‘data processor’. 

Data controller: This is a person or organization that decides how and why personal data is collected and used. Controllers have overall control over the data, therefore, the highest level of compliance responsibility. 

Data processor: This is a person or organization that handles personal data on behalf of the controller. Processors are responsible for ensuring the data processing is in line with the instructions of the controller, in addition to other legal obligations, including notifying the controller in the event of a data breach. 

Is your lead generation partner meeting GDPR requirements?

As a controller, it is important that you conduct due diligence on any third-party company you plan on using. You need to confirm the third-party’s compliance with the GDPR and any other relevant data privacy laws, such as the ePrivacy Directive and PECR, as detailed above. 

It is vital that you ensure the outsourced lead generation company has sufficient technical and organizational measures in place to protect the personal data they are processing on your behalf. 

For more detailed information about conducting due diligence on your data processors, read

Vendor due diligence and GDPR compliance with 5 practical steps.

Summary

Lead generation is an important aspect of business growth, but it must be conducted in line with the relevant data privacy laws. For North American organizations handling the personal data of EU and UK individuals, these include the EU GDPR, UK GDPR, ePrivacy Directive, and PECR. 

Before undertaking a lead generation strategy, it is essential that the correct measures are in place, including assigning the most appropriate lawful basis and ensuring the obligations and responsibilities as a data controller are understood and implemented. 

By understanding and adhering to the relevant regulations, organizations can prevent any future non-compliance issues as well as strengthening customer trust, confidence, and engagement. 

Confident customers lead to increased loyalty, which translates into becoming a more successful and sustainable business.  

Contact us to find out how an outsourced data privacy service can support you in maximising marketing ROI while staying compliant with EU and UK data privacy laws. 

Visit The DPO Centre to find out how an outsourced data privacy service can support you in maximising marketing ROI while staying compliant with EU and UK data privacy laws. 

Alternatively, you can get in touch by filling in the form below. 

____________________________________________________________________________________________________________

In case you missed it… 

• EU AI Act Compliance: What North American organizations need to know
• Data retention strategies for GDPR compliance
• How GDPR territorial scope impacts North American businesses

____________________________________________________________________________________________________________

Don’t miss out on the latest data protection updates – stay informed with our fortnightly newsletter, The DPIA

The post Lead generation and the GDPR: A guide for North American businesses appeared first on DPO Centre.

• How long should different types of personal data be retained? 
• What makes an effective data retention policy and schedule? 
• What responsibilities do data controllers, processors and sub-processors have for data retention? 

In this blog, we dive into these questions and share practical guidance – from determining the lifespan of different types of personal data to creating an effective data retention policy and schedule. 

GDPR and data retention

The General Data Protection Regulation (GDPR) has set new standards for the way businesses handle EU personal data, including what type of data is collected and the length of time it is kept. If your organization processes the data of individuals in the EU or European Economic Area (EEA), implementing a robust data retention policy is crucial. 

The GDPR’s principles of Storage Limitation, Minimisation, and Accuracy play a vital role in shaping such a policy. 

Storage Limitation: Ensure personal data is not retained beyond the necessary time period 

Minimisation: Collect only the minimal amount of data required 

Accuracy: Maintain accurate, up-to-date, and reliable information 

In other words, the processing of personal data must be adequate, relevant, and limited to what is necessary in relation to the specific purposes of the processing. You must only process personal data that is needed for the operations of your business. 

The GDPR doesn’t define exactly what ‘no longer than necessary’ means, so how can you judge timeframes? 

Necessity is a key factor in an effective data retention timeframe and is determined by your purpose for processing. In other words, your reason for handling and storing personal data will dictate the length of time you keep it. 

Storage periods will depend on several elements, such as the industry sector, the type of data processing, and any other regulatory requirements that apply. However, in some circumstances there is a statutory retention. For example, finance records in the UK and EU are generally maintained for 7 years (6 years plus current year), in accordance with the Companies Act.  

Under the GDPR, the key requirement for data retention is that the chosen duration must be justified, and this decision must be documented. 

The documents you will need to produce: 

• A data retention policy – This provides a general overview of the data management practices and is a broad document outlining how the organization manages its data, how long it keeps certain types of data, and the roles and responsibilities of staff 
• A data retention schedule – This is also known as a disposal schedule and is a more detailed document, specifying the exact retention period for different classes of records and the action needed to be taken at the end of the retention period 

Data retention roles: Controllers, processors and sub-processors  

Whether you’re a data controller, processor, or sub-processor, understanding your responsibilities and obligations is essential. It is important to manage data retention in a way that ensures compliance with the General Data Protection Regulation (GDPR) and meets your business needs. 

Data controllers

Data controllers determine the purpose of any personal data processed, and the means of processing. 

A data controller is primarily responsible for determining the data retention timeframe, as they decide the purposes and means of processing personal data. 

If you are the data controller, you must ensure you have a comprehensive data retention policy and schedule in place and communicate this to any data processors or sub-processors you have engaged, such as cloud storage companies or marketing agencies. As a controller, you carry the primary responsibility for complying with data protection laws. 

Data processors

Data processors process personal data on behalf of the controller, and sub-processors are third parties engaged by the processor. 

Data processors and sub-processors are responsible for processing personal data on behalf of the controller. They must follow the controller’s instructions, including abiding by a data retention timeframe, which should be set out in the contract or data processing agreement. Details should also include what will happen to the personal data once the contract is terminated.  

Top 4 data retention challenges and how to solve them

1. Changing regulatory landscape

Data protection laws continue to develop at a rapid pace around the world. Existing EU and UK privacy laws are also frequently updated. Organizations can struggle to keep up with these changes, especially when processing and storing personal data across multiple jurisdictions.

Advice: Keep updated on the latest data protection laws 

Seek advice from an experienced Data Protection Officer (DPO) who specializes in EU and UK data protection laws – a dedicated DPO will regularly review and update your data retention policies and schedules and ensure they are compliant with the latest regulations. 

Solution – Hire a dedicated Data Protection Officer (DPO) 

2. Data subject awareness

Individuals are increasingly aware of their rights and more likely to make a data subject access request (DSAR). This can place a burden on an organization’s data retention framework, as it must be equipped to efficiently locate, retrieve, and respond to a DSAR, providing the requested data within a strict timeframe. Read our DSAR FAQs for more information.

Advice: Proactively prepare for data subject requests

Ensure your organization has a well-documented and tested process for handling Data Subject Access Requests (DSARs). This includes training relevant staff, having clear workflows in place, and knowing where personal data is stored.  
 
Solution – establish a robust DSAR response process

3. Data volume

It can be difficult to manage the vast quantities of data that are collected daily from various digital channels, such as email, social media, websites, and virtual stores. Not to mention paper archive records, which can create a significant challenge for companies to organize.

Advice: Implement data minimisation practices

Only collect what is absolutely necessary. A practical tip is to conduct a data audit. This involves reviewing the types of personal data your organization collects and identifying what is needed. For example, an online store collects customer names, addresses and payment information for order fulfilment. However, the store also collects dates of birth and marital status, which, depending on the types of products sold, could be considered excessive and in breach of the GDPR’s data minimisation principle. 

Solution – Conduct a data audit and implement data minimisation practices 

4. Over-retention

Without specific rules on timeframes, organizations can often keep information far beyond its intended or necessary retention period. This can increase operational costs for storage, backup and retrieval. There is also the heightened risk of reputational damage if a cyber-attack or breach were to occur, which is a breach of the GDPR’s 5^th principle, and can potentially result in regulatory action.

Advice: Avoid keeping information for too long

It is important to have a clear data retention schedule for each type of data. Automated tools can be used to manage the schedule and delete or anonymise data that is no longer needed. Employees also need to be made aware of data retention policies and schedules, so they understand what to do with the data.   

Solution – Implement a clear data retention schedule 

Best practice tips for data retention

Effective management of personal data can help you to reduce risks and maintain compliance with data protection laws. 

Here are some helpful tips for your data retention strategy: 

To ensure compliance with the AI Act, organizations need to focus on critical areas such as staff training, robust corporate governance, and strong cybersecurity and data protection measures

• Conduct a data audit 
• Only collect data that is necessary for your purposes 
• Implement a data retention policy and schedule for each type of data collected 
• If data is kept for longer or shorter periods than the retention schedule, the reason for this needs to be documented 
• Review processing activities on a regular basis and add new ones to the schedule 
• Train staff on policy and schedule requirements, ensuring awareness of the operational requirements before any data is deleted, understanding that deleting data too soon is also considered a breach 
• Where there is a recommendation to archive older data, this can be in an electronic format and filed in a separate electronic folder, suitably labeled as holding archive material 
• Paper archive records need to be indexed and once retention is met, they should be destroyed safely and securely, using a confidential waste provider or cross cutting shredder 

See also the Retention Policy template in our free-to-download GDPR Toolkit 

Summary

There are several challenges for businesses when it comes to data retention and GDPR compliance. The key is to understand your organization’s purpose for collecting personal data and align this purpose with the principles of data minimisation, storage limitation and accuracy. 

Documentation is essential for GDPR compliance, and a comprehensive data retention policy and schedule are a requirement. However, it is important to remember that effective data management is not just about compliance.  

Individuals are more likely to engage with organizations they trust to handle their personal data responsibly. Investing in robust data management practices and having a well-defined data retention schedule is a win-win for both compliance and customer satisfaction. 

The DPO Centre has one of the largest teams of Data Protection Officers (DPOs), working globally with over 1,000 organizations across the spectrum of industry sectors, delivering GDPR compliance solutions. 

If you need help with your GDPR compliance or you are considering an outsourced data protection solution, please get in touch with our team

For more news and insights about data protection follow The DPO Centre on LinkedIn 

____________________________________________________________________________________________________________

In case you missed it… 

• EU AI Act Compliance part 4: Essential strategies for North American organizations
• How GDPR territorial scope impacts North American businesses
• Data Privacy Day 2025: Navigating privacy in Canada

____________________________________________________________________________________________________________

Don’t miss out on the latest data protection updates – stay informed with our fortnightly newsletter, The DPIA

The post Data retention strategies for GDPR compliance appeared first on DPO Centre.

For North American organizations, this often means implementing compliance measures that go beyond domestic requirements, particularly in areas like algorithmic transparency and bias testing.

If you’re developing or deploying AI systems for EU markets, your compliance journey is likely to be complex and demanding, especially if you’re managing high-risk systems. But compliance has to be approached as more than a tick-box exercise. It’s an opportunity to lead the way in responsible AI innovation, building trust with users and regulators alike.

By embracing compliance as a catalyst for more transparent AI usage, organizations can turn regulatory demands into a competitive advantage.

Before we dive into the specifics of the essential compliance strategies you should consider, here’s a quick overview of the main points we’ve previously addressed:

What we’ve covered so far

By following our blog series, you’ll already have taken the first steps in preparing for compliance with the EU AI Act. Specifically, you should have:

• Determined whether your AI system falls under the AI Act based on how it affects EU markets
• Identified any exemptions (e.g. research, military use)
• Clarified your role in the AI value chain (i.e. Provider, Deployer or another role)
• Understood the purpose of your system, and whether it’s classified as ‘prohibited’, ‘high-risk’ or a General Purpose AI model (GPAI)

The EU AI Act comes into full effect in August 2026

There are certain provisions coming into force earlier, such as a ban on systems that perform prohibited functions. It’s important organizations make sure they give themselves plenty of time and resources to meet all aspects of the AI Act’s implementation deadlines.

More detailed guidance on the timelines and deadlines, risk-based classifications, and compliance obligations, can be found in parts 1-3 of this blog series:

Compliance with the AI Act blog series

• Part 1: Essential knowledge for North American organizations
• Part 2: Understanding ‘high-risk’ activities
• Part 3: Roles and requirements for North American organizations

Let’s now look at some of the essential strategies you can implement to support your AI Act compliance journey.

Key strategies for EU AI Act compliance

1. Staff awareness and training

All organizations intending to use AI systems in any capacity should carefully consider the potential impact of those systems and engage in staff awareness and upskilling.

Training is essential to ensure all team members understand their roles in compliance and are able to implement the AI Act’s requirements.

A comprehensive training program should address the AI Act’s key requirements and include role-specific details. For example, AI developers may need more in-depth technical training, while Compliance Officers need to focus on documentation and regulatory obligations.

Tailor staff training programs to the specific risks associated with the type of data processed and the system’s intended use. For example, employees working with systems that have a greater impact on individuals, such as those making credit decisions affecting EU customers, may need more extensive training than those handling non-sensitive functions.

2. Establishing strong corporate governance

For Canadian and US organizations providing or deploying high-risk or General Purpose AI (GPAI) systems in EU markets, strong corporate governance is essential to demonstrate and maintain compliance. Without certain elements in place, organizations may struggle to meet the Act’s specific requirements and maintain the necessary compliance documentation.

To build and maintain strong corporate governance, organizations should focus on:

• Implementing effective risk and quality management systems to oversee and mitigate risks and help identify and address any issues early on
• Ensuring robust cybersecurity and data protection practices are in place to safeguard sensitive personal data and protect against data breaches
• Developing accountability structures with clear lines of responsibility to ensure compliance efforts are coordinated and effective
• Monitoring AI systems regularly and reporting on their performance and compliance status

Cybersecurity and data protection practices

To meet the stringent requirements of the AI Act, organizations should prioritize strong cybersecurity and data protection practices. This means embedding effective risk and quality management systems into your operations.

Without these practices, organizations may fail to meet specific requirements of the Act and will likely struggle to produce and maintain other compliance documentation that’s required.

For cybersecurity aspects, practices should include implementing robust infrastructure security with strict access controls, having a detailed incident response plan, and ensuring regular security audits to identify vulnerabilities.

The data protection requirements of the AI Act overlap with the EU’s General Data Protection Regulation (GDPR) in several areas and key principles,  particularly around transparency and accountability.

While the GDPR focuses on the protection of personal data, the AI Act covers the broader development and regulation of AI systems. This includes not only safeguarding personal data but also managing overall AI risks to ensure fairness, prevent harm, and promote transparency.

You can use the GDPR principles and current data protection practices to support compliance with the AI Act by integrating ‘Privacy by Design’  into your AI systems, conducting Impact Assessments for high-risk AI applications, and maintaining clear documentation of data protection activities.

3. Being ready for upcoming guidelines and templates

Available in the coming months – the EU is developing specific codes of practice and templated documentation to help organizations meet their compliance obligations.

We’ll provide updates in further blogs as these become available.

4. Following ethical AI principles and practices

Although guidelines and practical applications of the EU AI Act are still evolving, its core principles are well established in ethical AI frameworks. Organizations using AI, especially with personal data or human impact, must understand how the system works, its purpose, and its limits. Documenting these aspects supports best practice and accountability.

Organizations must also comply with transparency requirements under existing data protection laws in addition to the specifics of the AI Act.

Finally, it’s essential to conduct a risk assessment of how the AI system may impact individuals who interact with it and the organization’s liability and reputation if anything should go wrong. This proactive approach to AI governance is highly beneficial and can mostly be implemented without needing to tailor it for specific regulations.

5. Seeking expert guidance

There are resources available to support your compliance journey. This includes the EU AI Act Compliance Checker , a tool designed to help organizations verify that their AI system aligns with regulatory requirements.

However, the nuances of the AI Act are complex, and we urge every organization uncertain of its obligations to seek professional advice.

Key takeaways

• To ensure compliance with the AI Act, organizations need to focus on critical areas such as staff training, robust corporate governance, and strong cybersecurity and data protection measures
• Embedding ethical AI principles and maintaining transparency are essential for Canadian and US companies developing AI systems that serve EU markets, especially those impacting individuals and handling personal data
• Although practical guidelines for the Act are still to come, businesses should proactively implement these strategies and prepare for future updates

In conclusion: Staying ahead of AI regulations isn’t just about compliance – it’s an opportunity to build trust and lead the way in responsible AI innovation.

The DPO Centre has developed a comprehensive AI Audit and Impact Assessment service. If you need support beginning or continuing your AI compliance journey with confidence, please contact us.

____________________________________________________________________________________________________________

In case you missed it… 

• EU AI Act compliance part 3: Roles and requirements for North American organizations
• How GDPR territorial scope impacts North American businesses
• GDPR guide for SaaS companies expanding into EU & UK markets

____________________________________________________________________________________________________________

Don’t miss out on the latest data protection updates – stay informed with our fortnightly newsletter, The DPIA

The post EU AI Act Compliance part 4: Essential strategies for North American organizations appeared first on DPO Centre.

The AI Act will come into full effect in August 2026, 24 months after its official publication, although certain provisions will come into force earlier. For a detailed understanding of the AI Act’s implementation timeline, and further information about the risk-based classification of AI systems, please refer to Part 1 and Part 2 of our blog series:

Compliance with the AI Act Part 1: Timeline and important deadlines

Compliance with the AI Act Part 2: What is ‘high-risk’ activity?

Whether your organization develops AI chatbots for customer service, uses predictive algorithms for credit assessment, or deploys image recognition software, understanding your role and responsibilities under the EU AI Act is crucial for maintaining compliance when operating in European markets.

Navigating the AI Act’s global reach

Similar to the EU’s General Data Protection Regulation (GDPR), the AI Act has extra-territorial reach, making it a significant law with global implications. Its provisions apply to any organization marketing, deploying, or using an AI system that affects individuals or businesses in the EU, no matter where the system is developed or operated.

For example, if an AI system hosted in Toronto or San Francisco generates data or decisions that impact individuals or businesses in any of the EU’s 27 Member States, that system must comply with the AI Act.

The aim of the extra-territorial scope is to ensure the fundamental rights of EU residents are respected, regardless of international boundaries. This approach seeks to promote a consistent standard of ethical AI practices, encouraging all organizations to uphold high standards of accountability and transparency.

Key organizational roles under the AI Act

Compliance obligations for organizations are determined by two main factors:

1. The risk level of the AI system
2. The organization’s role in the supply chain

The risk classification of AI systems is detailed in Part 2 of our blog series. Therefore, let’s explore the various categories of roles organizations can play and the specific obligations associated with each.

What role does your organization play?

Under the AI Act, organizations fall into one of six distinct roles, each with its own set of obligations:

• Provider
  An individual or organization that develops an AI system and places it on the market. Providers are responsible for ensuring their system meets the necessary requirements of the AI Act.
• Deployer
  An individual or organization using an AI system developed by a Provider. A Deployer’s responsibilities under the AI Act are minimal if they use the AI system without changing it. If they modify the system significantly or use it under their own name or trademark, they take on the Provider’s responsibilities, as if they were the original Provider.
• Distributor
  An individual or organization making an AI system available on the EU Market, acting as an intermediary between provider and user.
• Importer
  Any natural or legal person based in the EU who brings an AI system into the EU market from outside the EU. This role is particularly relevant for North American organizations selling AI systems to EU customers.
• Product Manufacturer
  An individual or organization introducing or putting into service an AI system on the EU market as part of another product and brands it with their own name or trademark.
• Authorized Representative
  An individual or organization based in the EU who’s been formally appointed by a Provider located outside the EU. This role is especially important for North American companies without EU offices.

Representatives are responsible for managing and fulfilling regulatory obligations and documentation required by the AI Act on behalf of Providers. This is similar to the GDPR Representative role, although documentation is more detailed and extensive. This is because the AI Act involves complex regulatory requirements for AI systems, covering a broad range of technical, operational, and safety aspects.

Provider or Deployer? 

Carefully assess whether you’re a Provider or Deployer, as this will significantly affect your compliance responsibilities. It’s important to make sure how you deploy an AI system doesn’t inadvertently make you responsible as a Provider.

While most obligations fall on Providers, Deployers also have various responsibilities.

Common requirements for Providers AND Deployers

AI literacy – Providers and Deployers must ensure all staff and agents using AI systems have the appropriate knowledge. This depends on their roles and the associated risks, but is similar to mandatory data protection training under the GDPR.

Transparency – Providers and Deployers must ensure any AI system interacting with individuals (termed a ‘natural person’) meets transparency obligations, such as clearly marking content generated or manipulated by AI.

Registration – similar to data protection registration with a supervisory authority, Providers and Deployers must register the AI system in the EU’s database.

Provider-specific obligations

Because Providers design, develop, and bring AI systems to market, they bear primary responsibility for ensuring they meet safety and ethical standards. They also control the creation and operation of AI systems, so are crucial to ensuring systems meets the required standards for safety, effectiveness, and ethics.

Transparency and accountability: Two key principles of the AI Act

Providers must ensure their AI system is easy to understand, and clearly communicate its functionalities, limitations, and potential risks. This helps users know exactly what to expect and how to use it safely and effectively.

Key requirements for Providers include:

• Imposing responsibilities on importers and distributors – ensure all parties in the AI supply chain know about and adhere to their compliance standards, including completion of conformity assessments 
• Establishing a risk management system – a structured process to regularly review the AI system, identifying, evaluating and mitigating any risks
• Implementing effective data governance – develop clear procedures and processes for managing training data, including ensuring diversity and establishing protocols for data handling and data protection
• Preparing technical documentation – create detailed and accessible documentation about the AI system’s design, functionality, and performance to enable user understanding BEFORE it goes on market
• Maintaining event logs – set up automatic logging systems to track the AI system’s operations and any issues that may arise
• Creating usage documentation for Deployers – provide Deployers with clear and comprehensive guides on how to use the AI system (Deployers must also maintain documentation relevant to their use of the system, if it differs)
• Establishing human oversight – design the AI system to allow for human intervention and monitoring (also impacts Deployers)
• Ensuring accuracy and robustness – confirm the AI system is reliable and resilient in its operations, and suitable for its intended purpose
• Implementing cybersecurity measures – integrate strong cybersecurity practices to protect the AI system from potential threats
• Maintaining a quality management system – establish a quality management system to oversee ongoing development of the AI system
• Addressing issues and conformity – quickly address any issues with the AI system and withdraw any systems that don’t conform or comply with compliance standards (also impacts Deployers)
• Completing documentation and assessments – complete all documentation and conformity assessments accurately, and retain for at least 10 years
• Appointing a Representative – if needed, appoint a Representative to support compliance obligations and be a point of contact between Provider and regulatory authorities, particularly relevant for North American Providers based outside the EU
• Cooperating with supervisory authorities – be ready to liaise with regulatory bodies, providing requested information and helping with inspections or audits to show compliance
• Imposing responsibilities on importers and distributors – ensure all parties in the AI supply chain know about and adhere to their compliance standards, including completion of conformity assessments

In summary

The EU AI Act is a landmark piece of legislation, setting the first global standards for the responsible development and deployment of artificial intelligence systems.

As with many new regulations, the EU’s AI legislation has sparked concerns and debates among various stakeholders, including industry associations, tech companies, and legal professionals.

Their concerns echo the initial criticisms that surrounded the introduction of the EU’s General Data Protection Regulation (GDPR). Namely, the potential difficulties for organizations and businesses in interpreting and implementing its provisions.

However, despite its complexity, the AI Act, much like the GDPR, has a structured approach that makes implementation more manageable. There are clear definitions for the six roles in the AI supply chain. Each role comes with specific compliance obligations, with the Provider role having the greatest responsibilities.

Strategic Considerations for North American Organizations

With the AI Act coming into full effect in August 2026, it’s essential North American organizations operating in EU markets familiarize themselves with the compliance obligations and how they apply. 

Complying with the AI Act could serve as a market differentiator and a unique selling point that attracts clients and partners who value responsible and ethical AI practices.

If your organization would benefit from specialist data protection or AI governance advice for EU or UK markets, please contact us.

EU AI Act compliance part 4: Essential strategies for North American organizations

Coming next, in the final part of this blog series, we explore some of the best practices to guide you in meeting compliance requirements.

____________________________________________________________________________________________________________

In case you missed it… 

• EU AI Act compliance part 2: Understanding ‘high-risk’ activities
• How GDPR territorial scope impacts North American businesses
• GDPR guide for SaaS companies expanding into EU & UK markets

____________________________________________________________________________________________________________

Don’t miss out on the latest data protection updates – stay informed with our fortnightly newsletter, The DPIA

The post EU AI Act compliance part 3: Roles and requirements for North American organizations appeared first on DPO Centre.

For details of the AI Act’s timeline and deadlines for its phased implementation, see Part 1 of our blog series – EU AI Act compliance part 1: Timeline and important deadlines 

Understanding AI risk categories

The EU AI Act’s risk-based approach to classifying AI systems aims to balance innovation with regulation to prevent harm to health, and ensure safety and fundamental human rights. By assessing risk, the legislation recognizes that not all AI systems pose the same level of threat and that varying levels of control and oversight are required. 

AI systems are categorized into different risk levels based on their potential impact, with the burden of compliance increasing proportionate to the risk. 

These are the three main categories: 

• Prohibited 
• High risk 
• Low risk 

For Canadian and US organizations, these categories apply to any AI systems that affect EU residents or markets, no matter where the system is developed or operated. 

Prohibited systems

AI applications in this category are banned due to their unacceptable potential for negative consequences. 

High-risk systems

These systems have a significant impact on people’s safety, wellbeing and rights, so are subject to stricter requirements. 

Low-risk systems

These systems pose minimal dangers, so have fewer compliance obligations. 

AI applications prohibited by the Act

The prohibitions on unacceptable risk AI systems came into force on February 1, 2025 (see the timeline of the phased implementation schedule here). 

The European Commission will regularly review the list of prohibited AI applications, with the first review scheduled 12 months after the AI Act came into force. 

The table below details the types of AI practices that are the prohibited. These techniques and approaches pose unacceptable risks to health and safety or fundamental human rights, and while some of these practices may be permitted under North American regulations, they are prohibited when serving EU markets. 

What constitutes ‘high-risk’ activity?

Most of the AI Act addresses the regulation of high-risk AI systems, which fall into three distinct categories:

• Standalone AI products already covered by Union product safety laws 
• AI safety components 
• Designated ‘high-risk’ categories 

Let’s explore these high-risk categories in a little more detail: 

Standalone AI products 

This refers to AI systems that are not a component or feature of a larger product, but rather the product in its entirety. Many of these types of products are already regulated by certain EU harmonization laws. Examples include medical devices, heavy industrial machinery, cars, and toys. These are listed in Annex I of the AI Act. 

If you develop or deploy AI systems in a sector with tightly managed safety legislation, it’s highly likely the system will be covered here, and you should check the context of the Annex in full. 

As these products are already subject to strict safety regulations, they are automatically considered a high-risk category under the AI Act. 

AI safety components

This means where an AI system isn’t a standalone product but performs safety-related functions within a product. For example, where an AI system is used for monitoring, controlling, or managing safety features. 

Many of these systems are related to products listed in Annex I of the AI Act, such as industrial machinery, lifts, medical devices, motor vehicles etc. 

The graphic below details the timeline, including some additional and earlier deadlines for specific provisions. 

Designated ‘high-risk’ categories

Certain AI systems not listed in Annex I are also considered high risk. 

This defined list includes systems that would significantly impact people’s opportunities and potentially cause systemic bias against certain groups. 

These systems fall into 8 broad areas: 

Biometrics 

Certain biometric processing is entirely prohibited, as detailed above, but all other biometric processing is classified as high risk (with the exception of ID verification of an individual for cybersecurity purposes – for example, Windows Hello and other biometric login systems used in North American workplaces).  

Critical infrastructure
 

• AI systems used as safety components in managing critical digital infrastructure (similar to the list in Annex I) and utility systems – this applies to Canadian and US organizations providing services or infrastructure solutions to EU markets.  

Education 

• Any AI system determining admissions or evaluating learning outcomes are high risk due to the potential impact on lives (including online learning platforms serving EU students), for example, the risk of perpetuating historic discrimination of women and ethnic minorities.  

Employment & management 

• Any AI system used for recruitment, job application analysis, and candidate evaluation are considered high risk (including North American companies hiring for EU operations or processing EU candidate data). Also, decision-making AI tools used for performance monitoring, work relationships, or termination of employment are high risk.  

Access to essential services 

• Systems determining access to essential services such as public benefits like unemployment, disability and healthcare, or private benefits such as credit scoring systems. This includes Canadian and US financial institutions providing services to EU customers. 

Law enforcement

• Certain tasks are considered high risk, including using lie detectors or similar biometric tools used for testimony assessment, and systems used to assess the likelihood of an individual reoffending.  

Immigration 

• Systems used to assess the security risk of migrants entering the EU, or to process and evaluate asylum claims. AI systems used to verify ID documents are exempt from this.  

Administration of justice and democratic processes 

• This includes AI systems used in legal research or interpreting the law, such as legal databases used by lawyers and judges. Also, systems that could influence voting, like those used to target political ads. 

Exceptions to high-risk and prohibited AI systems

The AI Act exempts certain AI systems otherwise considered high risk or prohibited. 

Prohibited system exemptions are notably for research and national security. 

High-risk system exemptions can apply if the AI system: 

• Performs only a narrow procedural task 
• Improves on the result of a previously completed human activity 
• Detects or monitors bias or other patterns in decision-making, but doesn’t replace human decision-making and is subject to human review 
• Is used for a preparatory task relevant to the assessment of an otherwise high-risk task i.e. you can use AI to help you assess your use case 

What this means for organizations using high-risk AI systems

For Canadian and US organizations, this often means conducting additional risk assessments beyond those required by domestic regulations.  

High-risk AI systems supplied to the EU or affecting EU residents need thorough risk and security assessments and may need EU registration and third-party evaluation. There are also substantial transparency obligations, and users must be clearly informed about how an AI system is deployed and functions. For North American organizations operating globally, this may require maintaining different AI system configurations for EU and non-EU markets. 

If you need advice on ensuring your organization’s AI systems comply with EU requirements, while maintaining efficient operations across North American and European markets, please contact our specialized DPO team. 

EU AI Act compliance part 3: Scope and obligations

Coming next, in part 3 of our blog series, we cover the obligations of the AI Act in more detail, including who the AI Act applies to and what is required. 

Don’t miss out on the latest data protection updates – stay informed with our fortnightly newsletter, The DPIA.

____________________________________________________________________________________________________________

In case you missed it… 

• EU AI Act compliance part 1: Timeline and important deadlines 
• How GDPR territorial scope impacts North American businesses 
• GDPR advise for SaaS companies expanding into EU and UK markets 

____________________________________________________________________________________________________________

For more news and insights about data protection follow The DPO Centre on LinkedIn

The post EU AI Act compliance part 2: Understanding ‘high-risk’ activities appeared first on DPO Centre.

If your organization operates in or serves EU markets and has AI-driven chatbots to handle customer inquiries, develops predictive algorithms for credit risk, or uses image recognition software, the EU’s AI Act may impact how you handle data. 

Understanding the requirements of the AI Act and what will apply to your organization is crucial for compliance. 

In our four-part blog series, we cover: 

1. Timeline and deadlines 
2. What constitutes a high-risk activity? 
3. Who has to comply with the AI Act? 
4. Strategies for achieving AI Act compliance 

EU AI Act compliance part 1: Timeline and important deadlines

The AI Act was approved by the European Council in May 2024. It has a phased implementation schedule over two years, designed to give organizations time to make the necessary changes for compliance. 

The new legislation applies to public and private organizations operating in the EU that develop, deploy, or use AI systems in the EU’s single market. For North American organizations, this includes companies doing business in the EU or providing AI-powered services to EU customers, as well as institutions, government bodies, research organizations and any others involved in AI-related activities that impact EU markets. 

How the AI Act and the GDPR work together 

David Smith, DPO and AI Sector Lead explains: 

‘In many cases the AI Act and the GDPR will complement each other. The AI Act is essentially a product safety legislation designed to ensure the responsible and non-harmful deployment of AI systems. The GDPR is a principles-based law, protecting fundamental human privacy rights.’ 

When did the AI Act come into force?

The AI Act’s finalized text was published in the Official Journal of the European Union on July 12, 2024. It officially entered into force 20 days after publication on August 1, 2024, with the enforcement of most of its provisions starting on August 2, 2026. 

The graphic below details the timeline, including some additional and earlier deadlines for specific provisions. 

August 1, 2024: The AI Act becomes law

February 1, 2025 (+6 months)

Prohibitions on unacceptable risk AI systems apply six months after the AI Act became law.  

Banned AI practices are those deemed to pose unacceptable risks to health and safety or fundamental human rights. We will cover prohibited AI applications in more detail in our next blog. 

With the deadline for compliance on unacceptable risk AI systems already past, organizations should evaluate their risk exposure in this area urgently if they haven’t yet done so. 

May 1, 2025 (+9 months)

The AI Office will finalize the codes of conduct to cover the obligations for developers and deployers of AI systems. These codes will provide voluntary guidelines for responsible AI development and use. 

August 1, 2025 (+12 months)

The rules for providers of General Purpose AI (GPAI) will come into effect and organizations will need to align their practices with these new rules. GPAI refers to advanced AI systems that can perform a wide range of tasks. These include high-compute models where training contains more than 10^25 FLOPS, such as ChatGPT. 

In addition, the first European Commission annual review of the list of prohibited AI applications will happen 12 months after the AI Act enters into force. 

February 1, 2026 (+18 months)

The European Commission will issue implementing acts for high-risk AI providers. This means organizations using high-risk AI systems must follow a standard template to monitor the AI systems after deployment. 

The monitoring plan will help to identify and address any issues or risks, promptly. 

August 1, 2026 (+24 months)

The remainder of the AI Act will apply, including regulations on high-risk AI systems listed in Annex III* of the AI Act. These systems include those related to biometrics and cover technologies such as fingerprint recognition, facial recognition, iris scanning and voice authentication. 

We cover high-risk AI systems in more detail in our next blog. 

EU Artificial Intelligence Act Annex III 

August 1, 2027 (+36 months)

Regulations for high-risk AI systems stipulated in Annex I** become effective. 

EU Artificial Intelligence Act Annex I

By the end of 2030

There are some minor exceptions for certain complex public sector systems that have a longer compliance timeline. 

Coming up next…

EU AI Act compliance part 2: What is ‘high-risk’ activity?

Stay tuned for the second blog in our four-part series, which covers all you need to know about prohibited AI applications and what is categorized as a high-risk activity – stay tuned! 

In the meantime, should you require any advice on EU or UK jurisdiction data protection, our team of expert DPOs can help. We offer a wide range of outsourced privacy services, including AI Governance support for North American organizations operating in EU markets. CONTACT US 

For more privacy updates and breaking news, sign up to our fortnightly newsletter. 

____________________________________________________________________________________________________________

In case you missed it… 

• How GDPR territorial scope impacts North American businesses 
• GDPR advise for SaaS companies expanding into EU and UK markets 
• GDPR Representative: Do you need one? 

____________________________________________________________________________________________________________

For more news and insights about data protection follow The DPO Centre on LinkedIn

The post EU AI Act compliance: What North American organizations need to know  appeared first on DPO Centre.

In this blog, we look at some of the major events and news stories that have shaped the landscape, influencing the direction of policies and processes.

What does the development of data protection laws mean for organisations? And how will the data protection industry continue to evolve? Big questions to keep in mind as we go into 2024.

Major data protection events

5 years of the GDPR: The General Data Protection Regulation (GDPR) celebrated its 5^th anniversary on 25 May 2023. Coming into force on 25 May 2018, it is cited as one of the toughest pieces of privacy legislation in the world. The EU’s principle-based directive was introduced to protect the fundamental rights of individuals by safeguarding their personal data and creating a harmonised framework for data flow across the EU’s digital single market.

To mark the anniversary, The DPO Centre held a webinar to discuss the wins and challenges for businesses. Essentially, what worked, what didn’t, and why? Watch The DPO Centre’s lively GDPR debate here

Facebook fined a record €1.2 billion: On 22 May 2023, after 10 years of litigation and 3 court procedures, the Irish Data Protection Commission issued Meta Ireland with the largest GDPR fine to date. It was the fourth fine Meta received this year. The Commission issued two penalties in January 2023 for breaching rules with targeted ads on Facebook and Instagram and in March 2023, a fine for GDPR breaches with WhatsApp.

The fines sent a strong message to Tech giants that they cannot continue to neglect their obligations for compliance with data protections regulations. However, Meta has yet to pay the fine and announced its intention to appeal. One of the orders of the penalty charge was for Meta to discontinue its reliance on Standard Contractual Clauses (SCCs) by 12 October. In an update on 7 September 2023, Meta announced they will rely on the new EU-US DPF for data transfers.

The AI Safety Summit took place in the UK on 1 November 2023 at Bletchley Park. Intended as a landmark event for artificial intelligence, the event brought together leading experts, researchers, and policymakers from around the world.

An important outcome of the Summit was The Bletchley Declaration – a world-first agreement between 28 jurisdictions, including the EU, the US, and China. The Declaration establishes a shared responsibility to understand and manage the potential risks of AI development. Bias and privacy are topics covered within the Declaration, providing an agenda to focus on building respective risk-based policies across the countries. However, critics have highlighted the lack of detail and the absence of any actionable points for building an effective regulatory framework.

Data protection developments in the EU, UK, and North America

Europe’s GDPR continues to mature

Since its implementation in 2018, the General Data Protection Regulation (GDPR) has become a global standard for data protection. With each passing year, we see further clarification on its interpretation, and a greater understanding of the implications for businesses and individuals alike.

There were several key court rulings by the Court of Justice of the European Union (CJEU) this year, which have helped to clarify certain areas of the legislation:

• Accountability principle – The CJEU ruled that not every violation of the GDPR would render all related processing to be unlawful (Case C-60/22)
• Right of Access – The CJEU clarified the scope of the GDPR right of access by stating that the right to obtain a ‘copy’ of personal data means that the data subject must be given a ‘faithful and intelligible’ reproduction of all those data
• Joint Controllers – The CJEU stated that if a company doesn’t follow GDPR rules for making a joint controller agreement or keeping records of data processing activities, it doesn’t automatically mean that the company’s data processing is illegal.
• Penalty fines – The CJEU ruled on 5 December 2023 that a supervisory Data Protection Authority (DPA) may only impose a fine for a GDPR infringement if it was committed wrongfully, either intentionally or negligently. In calculating a fine, a DPA must consider the total worldwide turnover of the entire group from the preceding business year.

The European Commission adopted its adequacy decision on EU-US data flows and established the EU-US Data Privacy Framework (DPF), which came into effect on 10 July 2023. The DPF replaced the invalidated Privacy Shield and aimed to address the concerns previously raised by the CJEU. However, only minutes after the announcement, Max Schrems, Austrian privacy lawyer and activist, expressed his scepticism of the decision and stated his intention to challenge the new deal. A challenge has yet to be submitted by Mr Schrems, but the debate over transatlantic data transfers is clearly not over and will continue into 2024. Learn more about the EU-US DPF

UK’s key data protection updates

The UK-US ‘data-bridge’ was approved on 21 September 2023, with it coming into force on 12 October 2023. Serving as an extension to the EU’s Data Privacy Framework (DPF), the data-bridge provides a mechanism for businesses in the UK to transfer personal data to US organisations certified under the ‘UK Extension to the EU-US Data Privacy Framework’ (UK Extension) without the need for further safeguards. However, criticisms of the EU-US DPF include concerns over the potential for increased surveillance by US authorities and the erosion of privacy rights. Many organisations have retained their existing data transfer mechanisms with a ‘wait and see’ approach.

DSIT published AI Skills for Business Competency Framework for public consultation in November 2023. Supported by the Office for Artificial Intelligence within the Department for Science, Innovation and Technology (DSIT), the draft framework presents guidance on the essential knowledge, skills, and behaviours employees should have to benefit from AI technology. DSIT intends the framework to support businesses, enabling them to understand their AI upskilling needs and to assist training providers in developing relevant training solutions. Read the draft AI Skills for Business framework

The UK’s proposed GDPR replacement moves closer

On 19 December 2023 the Data Protection and Digital Information (DPDI) Bill was debated at the second reading stage in the House of Lords. The government believes the updates to the current UK GDPR will support innovation and reduce unnecessary burdens on businesses and organisations. However, the new legislation has the potential to increase costs and complexities for all but the smallest of businesses.

The Lords raised many concerns during the second reading, with Lord Bishop of Southwell and Nottingham quoting Rob Masson of The DPO Centre. The Lord Bishop used Mr Masson’s words when calling attention to the way in which the UK seems to be going in the opposite direction to the rest of the globe by lowering data protection standards.

Lord Allan of Hallam said, ‘It is the concern around EU adequacy that I think should really be front and centre of our discussions when we consider this legislation.’

This concern was echoed by several other Members, with Lord Vaux of Harrowden succinctly stating, ‘We must get this Bill right. If we do not, we risk substantial damage to the economy, businesses, individuals’’ privacy rights – especially children – and even, as far as the surveillance elements go, to our status as a free and open democratic society.’
Read the key differences between the UK GDPR and DPDI

Canada seeks to update and strengthen its privacy laws

There have been significant developments in Canada’s privacy laws this year. On 24 April, the Canadian House of Commons agreed on the entirety of Bill C-27, the Digital Charter Implementation Act 2022, which seeks to update and strengthen the Personal Information Protection and Electronic Documents Act (PIPEDA), including Canada’s first AI legislation.

In Quebec, ‘An Act to modernise legislative provisions as regards the protection of personal information’ came into effect in 22 September 2023, with the right to portability under this Act is due to come into force on 22 September 2024.
Read the PDF of Bill 64 

The United States sees a wave of new privacy laws

It was a big year for privacy in the US, with 5 new state privacy laws:

• California Privacy Rights Act (CPRA) came into effect on 1 January 2023 and amends the California Consumer Privacy Act (CCPA)
• Virginia Consumer Data Protection Act (VCDPA) came into effect on 1 January 2023
• The Colorado Privacy Act (CPA) came into effect on 1 July 2023
• The Connecticut Data Privacy Act (CTDPA) came into effect on 1 July 2023
• The Utah Consumer Privacy Act (UCPA) will come into effect on 31 December 2023

These laws reflect a shift towards greater consumer control over personal data and increased obligations for organisations in terms of data processing. They also indicate a move towards harmonising state-level laws with global standards, providing new consumer rights aligned with those in the GDPR.

Looking ahead: Data protection in 2024

Subscribe to The DPIA – Keep updated on the latest, most important data protection news with our fortnightly email newsletter.

UK’s DPDI Bill

As we move into 2024, all eyes are carefully watching the progress of the proposed Data Protection and Digital Information (DPDI) Bill. The hope of the data protection industry is that the Lords will take into consideration their numerous concerns and apply rigorous scrutiny to the proposed legislation. But only time will tell. We will keep you updated soon as we have further information.

3^rd party cookies in Chrome to be disabled

Google’s plan to phase out 3^rd party cookies in its Chrome browser begins in quarter 1 of 2024. This is part of a larger initiative called the Privacy Sandbox project, which aims to reduce cross-site tracking whilst still allowing functionality to keep online services and content freely available.

Google will disable 3^rd party cookies for 1% of users from early January, applying the changes to 100% of users by Q3 2024. The full rollout depends on Google addressing the competition concerns of the UK’s Competition and Markets Authority (CMA). The phasing out of non-essential cookies is in line with the wider global trend towards enhanced data protection and privacy.

The EU’s proposed ePrivacy Regulation establishes clearer rules on cookies, with a more streamlined solution for settings:

‘no consent is needed for non-privacy intrusive cookies that improve internet experience, such as cookies to remember shopping-cart history or to count the number of website visitors.’ (Proposal for an ePrivacy Regulation)

International data transfers

SCCs and IDTA – From 21 March 2024, UK organisations can no longer use the old EU Standard Contractual Clauses (SCCs) for restricted data transfers. Instead, they must rely on the UK’s International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum (‘UK Addendum’).

EU-UK adequacy – Later in 2024, the European Commission is due to review the EU-UK adequacy, which will expire on 27 June 2025. The outcome of the UK’s proposed DPDI Bill could significantly affect this decision and create further complications for organisations operating across multiple jurisdictions.

EDPB action: Right of access by controllers

The European Data Protection Board (EDPB) will launch a national action in 2024 on ‘The right of access by controllers’. Each year, the EDPB seeks to prioritise certain topics for data protection authorities (DPAs) to work on at a national level. This will be the third co-ordinated enforcement action to date. The results allow for analysis and insight into the topic, which allows for targeted follow-up at both national and EU levels.

The EU’s AI Act

With European Parliamentary Elections scheduled for 6-9 June 2024, the EU is likely to adopt the proposed AI Act in early 2024. Otherwise, the elections could delay its passage until 2025. The Act has seen a certain amount of progress in 2023, with the European Parliament adopting amendments to the proposal on 14 June 2023. However, there have been stumbling blocks, especially over the way generative AI platforms like ChatGPT should be regulated. Big Tech companies have been lobbying to weaken the proposed EU legislation and there have also been calls from the French, German, and Italian governments to reduce some of the stringent measures to ensure AI innovation.

The UK’s AI Regulation Bill

The AI Regulation Bill is a Private Member’s Bill, originating in the House of Lords during the 2023-24 session. Last updated on 29 November 2023, the Bill includes provisions for the creation of a body called the AI Authority and the appointment of designated AI officers. The government intends to publish a draft AI risk register for consultation, an updated AI regulatory roadmap, and a monitoring and evaluation report after March 2024.

Data Protection support and advice for 2024

Data protection and privacy is a rapidly evolving industry. The pace of change is a challenge for organisations across all sectors, with new laws and new guidance being released regularly. The ever-pressing need for professional advice and guidance from data protection experts looks set to increase as we move into 2024.

The DPO Centre offers a range of data protection services, including consultancy, outsourced Data Protection Officers (DPOs), GDPR Representatives and AI Explainability (XAI) Services.

This year has seen significant progress in the data protection industry, with many new privacy laws being enacted across the globe.

In this blog, we look at some of the major events and news stories that have shaped the landscape, influencing the direction of policies and processes.

What does the development of data protection laws mean for organisations? And how will the data protection industry continue to evolve? Big questions to keep in mind as we go into 2024.

Major data protection events

5 years of the GDPR: The General Data Protection Regulation (GDPR) celebrated its 5^th anniversary on 25 May 2023. Coming into force on 25 May 2018, it is cited as one of the toughest pieces of privacy legislation in the world. The EU’s principle-based directive was introduced to protect the fundamental rights of individuals by safeguarding their personal data and creating a harmonised framework for data flow across the EU’s digital single market.

To mark the anniversary, The DPO Centre held a webinar to discuss the wins and challenges for businesses. Essentially, what worked, what didn’t, and why? Watch The DPO Centre’s lively GDPR debate here

Facebook fined a record €1.2 billion: On 22 May 2023, after 10 years of litigation and 3 court procedures, the Irish Data Protection Commission issued Meta Ireland with the largest GDPR fine to date. It was the fourth fine Meta received this year. The Commission issued two penalties in January 2023 for breaching rules with targeted ads on Facebook and Instagram and in March 2023, a fine for GDPR breaches with WhatsApp.

The fines sent a strong message to Tech giants that they cannot continue to neglect their obligations for compliance with data protections regulations. However, Meta has yet to pay the fine and announced its intention to appeal. One of the orders of the penalty charge was for Meta to discontinue its reliance on Standard Contractual Clauses (SCCs) by 12 October. In an update on 7 September 2023, Meta announced they will rely on the new EU-US DPF for data transfers.

The AI Safety Summit took place in the UK on 1 November 2023 at Bletchley Park. Intended as a landmark event for artificial intelligence, the event brought together leading experts, researchers, and policymakers from around the world.

An important outcome of the Summit was The Bletchley Declaration – a world-first agreement between 28 jurisdictions, including the EU, the US, and China. The Declaration establishes a shared responsibility to understand and manage the potential risks of AI development. Bias and privacy are topics covered within the Declaration, providing an agenda to focus on building respective risk-based policies across the countries. However, critics have highlighted the lack of detail and the absence of any actionable points for building an effective regulatory framework.

Data protection developments in the EU, UK, and North America

Europe’s GDPR continues to mature

Since its implementation in 2018, the General Data Protection Regulation (GDPR) has become a global standard for data protection. With each passing year, we see further clarification on its interpretation, and a greater understanding of the implications for businesses and individuals alike.

There were several key court rulings by the Court of Justice of the European Union (CJEU) this year, which have helped to clarify certain areas of the legislation:

• Accountability principle – The CJEU ruled that not every violation of the GDPR would render all related processing to be unlawful (Case C-60/22)
• Right of Access – The CJEU clarified the scope of the GDPR right of access by stating that the right to obtain a ‘copy’ of personal data means that the data subject must be given a ‘faithful and intelligible’ reproduction of all those data
• Joint Controllers – The CJEU stated that if a company doesn’t follow GDPR rules for making a joint controller agreement or keeping records of data processing activities, it doesn’t automatically mean that the company’s data processing is illegal.
• Penalty fines – The CJEU ruled on 5 December 2023 that a supervisory Data Protection Authority (DPA) may only impose a fine for a GDPR infringement if it was committed wrongfully, either intentionally or negligently. In calculating a fine, a DPA must consider the total worldwide turnover of the entire group from the preceding business year.

The European Commission adopted its adequacy decision on EU-US data flows and established the EU-US Data Privacy Framework (DPF), which came into effect on 10 July 2023. The DPF replaced the invalidated Privacy Shield and aimed to address the concerns previously raised by the CJEU. However, only minutes after the announcement, Max Schrems, Austrian privacy lawyer and activist, expressed his scepticism of the decision and stated his intention to challenge the new deal. A challenge has yet to be submitted by Mr Schrems, but the debate over transatlantic data transfers is clearly not over and will continue into 2024. Learn more about the EU-US DPF

UK’s key data protection updates

The UK-US ‘data-bridge’ was approved on 21 September 2023, with it coming into force on 12 October 2023. Serving as an extension to the EU’s Data Privacy Framework (DPF), the data-bridge provides a mechanism for businesses in the UK to transfer personal data to US organisations certified under the ‘UK Extension to the EU-US Data Privacy Framework’ (UK Extension) without the need for further safeguards. However, criticisms of the EU-US DPF include concerns over the potential for increased surveillance by US authorities and the erosion of privacy rights. Many organisations have retained their existing data transfer mechanisms with a ‘wait and see’ approach.

DSIT published AI Skills for Business Competency Framework for public consultation in November 2023. Supported by the Office for Artificial Intelligence within the Department for Science, Innovation and Technology (DSIT), the draft framework presents guidance on the essential knowledge, skills, and behaviours employees should have to benefit from AI technology. DSIT intends the framework to support businesses, enabling them to understand their AI upskilling needs and to assist training providers in developing relevant training solutions. Read the draft AI Skills for Business framework

The UK’s proposed GDPR replacement moves closer

On 19 December 2023 the Data Protection and Digital Information (DPDI) Bill was debated at the second reading stage in the House of Lords. The government believes the updates to the current UK GDPR will support innovation and reduce unnecessary burdens on businesses and organisations. However, the new legislation has the potential to increase costs and complexities for all but the smallest of businesses.

The Lords raised many concerns during the second reading, with Lord Bishop of Southwell and Nottingham quoting Rob Masson of The DPO Centre. The Lord Bishop used Mr Masson’s words when calling attention to the way in which the UK seems to be going in the opposite direction to the rest of the globe by lowering data protection standards.

Lord Allan of Hallam said, ‘It is the concern around EU adequacy that I think should really be front and centre of our discussions when we consider this legislation.’

This concern was echoed by several other Members, with Lord Vaux of Harrowden succinctly stating, ‘We must get this Bill right. If we do not, we risk substantial damage to the economy, businesses, individuals’’ privacy rights – especially children – and even, as far as the surveillance elements go, to our status as a free and open democratic society.’
Read the key differences between the UK GDPR and DPDI

Canada seeks to update and strengthen its privacy laws

There have been significant developments in Canada’s privacy laws this year. On 24 April, the Canadian House of Commons agreed on the entirety of Bill C-27, the Digital Charter Implementation Act 2022, which seeks to update and strengthen the Personal Information Protection and Electronic Documents Act (PIPEDA), including Canada’s first AI legislation.

In Quebec, ‘An Act to modernise legislative provisions as regards the protection of personal information’ came into effect in 22 September 2023, with the right to portability under this Act is due to come into force on 22 September 2024.
Read the PDF of Bill 64 

The United States sees a wave of new privacy laws

It was a big year for privacy in the US, with 5 new state privacy laws:

• California Privacy Rights Act (CPRA) came into effect on 1 January 2023 and amends the California Consumer Privacy Act (CCPA)
• Virginia Consumer Data Protection Act (VCDPA) came into effect on 1 January 2023
• The Colorado Privacy Act (CPA) came into effect on 1 July 2023
• The Connecticut Data Privacy Act (CTDPA) came into effect on 1 July 2023
• The Utah Consumer Privacy Act (UCPA) will come into effect on 31 December 2023

These laws reflect a shift towards greater consumer control over personal data and increased obligations for organisations in terms of data processing. They also indicate a move towards harmonising state-level laws with global standards, providing new consumer rights aligned with those in the GDPR.

Looking ahead: Data protection in 2024

Subscribe to The DPIA – Keep updated on the latest, most important data protection news with our fortnightly email newsletter.

UK’s DPDI Bill

As we move into 2024, all eyes are carefully watching the progress of the proposed Data Protection and Digital Information (DPDI) Bill. The hope of the data protection industry is that the Lords will take into consideration their numerous concerns and apply rigorous scrutiny to the proposed legislation. But only time will tell. We will keep you updated soon as we have further information.

3^rd party cookies in Chrome to be disabled

Google’s plan to phase out 3^rd party cookies in its Chrome browser begins in quarter 1 of 2024. This is part of a larger initiative called the Privacy Sandbox project, which aims to reduce cross-site tracking whilst still allowing functionality to keep online services and content freely available.

Google will disable 3^rd party cookies for 1% of users from early January, applying the changes to 100% of users by Q3 2024. The full rollout depends on Google addressing the competition concerns of the UK’s Competition and Markets Authority (CMA). The phasing out of non-essential cookies is in line with the wider global trend towards enhanced data protection and privacy.

The EU’s proposed ePrivacy Regulation establishes clearer rules on cookies, with a more streamlined solution for settings:

‘no consent is needed for non-privacy intrusive cookies that improve internet experience, such as cookies to remember shopping-cart history or to count the number of website visitors.’ (Proposal for an ePrivacy Regulation)

International data transfers

SCCs and IDTA – From 21 March 2024, UK organisations can no longer use the old EU Standard Contractual Clauses (SCCs) for restricted data transfers. Instead, they must rely on the UK’s International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum (‘UK Addendum’).

EU-UK adequacy – Later in 2024, the European Commission is due to review the EU-UK adequacy, which will expire on 27 June 2025. The outcome of the UK’s proposed DPDI Bill could significantly affect this decision and create further complications for organisations operating across multiple jurisdictions.

EDPB action: Right of access by controllers

The European Data Protection Board (EDPB) will launch a national action in 2024 on ‘The right of access by controllers’. Each year, the EDPB seeks to prioritise certain topics for data protection authorities (DPAs) to work on at a national level. This will be the third co-ordinated enforcement action to date. The results allow for analysis and insight into the topic, which allows for targeted follow-up at both national and EU levels.

The EU’s AI Act

With European Parliamentary Elections scheduled for 6-9 June 2024, the EU is likely to adopt the proposed AI Act in early 2024. Otherwise, the elections could delay its passage until 2025. The Act has seen a certain amount of progress in 2023, with the European Parliament adopting amendments to the proposal on 14 June 2023. However, there have been stumbling blocks, especially over the way generative AI platforms like ChatGPT should be regulated. Big Tech companies have been lobbying to weaken the proposed EU legislation and there have also been calls from the French, German, and Italian governments to reduce some of the stringent measures to ensure AI innovation.

The UK’s AI Regulation Bill

The AI Regulation Bill is a Private Member’s Bill, originating in the House of Lords during the 2023-24 session. Last updated on 29 November 2023, the Bill includes provisions for the creation of a body called the AI Authority and the appointment of designated AI officers. The government intends to publish a draft AI risk register for consultation, an updated AI regulatory roadmap, and a monitoring and evaluation report after March 2024.

Data Protection support and advice for 2024

Data protection and privacy is a rapidly evolving industry. The pace of change is a challenge for organisations across all sectors, with new laws and new guidance being released regularly. The ever-pressing need for professional advice and guidance from data protection experts looks set to increase as we move into 2024.

The DPO Centre offers a range of data protection services, including consultancy, outsourced Data Protection Officers (DPOs), GDPR Representatives and AI Explainability (XAI) Services.

The post Data Protection in 2023: A year in review appeared first on DPO Centre.