Collecting and processing data

– The first step in ensuring data protection is to understand what data is collected and for what purpose. It is important to collect only the personal data that is necessary for business operations. Additionally, there must always be a legal basis for processing the data, such as customer consent or a contract, emphasises Communications Manager Johanna Hietikko-Koljonen.

A clear privacy policy is also an essential part of data protection:

– Every company should have a clear and understandable privacy policy. The privacy policy informs customers about what data is collected, for what purpose, how it is processed, and who processes it. The policy should be easily accessible, for example, on the company’s website or at a physical location, advises Hietikko-Koljonen.

Rights of data subjects and data security

GDPR grants data subjects several rights, such as the right to inspect, correct, and delete their data. Protecting the collected data is of utmost importance.

– This can include technical measures such as encryption and access control, as well as organisational measures like regular security audits. Data security is an ongoing process that requires continuous monitoring and improvement, stresses Hietikko-Koljonen, and continues:

– In simple terms, it is necessary to define and limit who can access which systems and data. Additionally, access to different programs should always be behind personal user credentials and preferably also two-factor authentication. Therefore, the use of shared passwords written on sticky notes must be abandoned.

It is also important to define for how long personal data is retained.

– Data should only be retained for as long as necessary, and unnecessary data should be properly deleted. This helps reduce security risks and comply with GDPR requirements, notes Hietikko-Koljonen.

If your company processes large amounts of personal data or special categories of personal data, it may be necessary to appoint a Data Protection Officer. The Data Protection Officer is responsible for monitoring and developing data protection matters and can be an invaluable help in ensuring data protection.

Data protection training and breaches

All employees must understand the importance of data protection and know how to act accordingly.

– Regular data protection training helps ensure that staff know how to handle data protection matters, process personal data, and respond to potential data security breaches, states Hietikko-Koljonen.