BSI launches GDPR compliance service for non-EU countries
17 December 2020 | 0
The cybersecurity and information resilience team at BSI have announced the introduction of an Article 27 Representative Service to support European Union (EU) and non-EU organisations with General Data Protection Regulation (GDPR) compliance obligations.
Article 27 of the GDPR mandates that an organisation must have an EU-based Representative if it does not have an EU-based establishment and provides goods or services into the EU or monitors EU based data subjects. The representative is responsible for acting as a contact point for data subjects, the supervisory authorities within the EU, for maintaining a copy of the Article 30 Record of Processing Activities (RoPA) of the non-EU organisation and providing any information the supervisory authorities require for the performance of their tasks such as queries or for supervision activities.
The new privacy service offering at BSI will offer independent expert representation on behalf of global clients to ensure organisations meet both EU and UK data protection compliance obligations. The Article 27 Representative Service is separate to that of a Data Protection Officer (DPO), acting as a main point of contact for EU or UK data subjects and EU or UK supervisory authorities for organisations who do not have a presence in the relevant country.
“The Brexit transition period ends on the 31 December and will have a significant impact on data protection compliance for thousands of companies,” said Conor Hogan, global practice lead – privacy – cyber, risk & advisory at BSI. “This affects UK organisations with no establishment in the EU, who sell goods or services into the EU or monitor EU-based data subjects and will also affect EU organisations who have no presence in the UK but sell goods or services into the UK or monitor UK-based data subjects.”
“While Article 27 is not a new addition to the GDPR and applies to organisations all over the world, it does become crucially important when managing business with the UK from the 1 January,” continued Hogan. “Organisations need to be aware of the variety of changes the UK’s exit from the EU may bring to their business operations including data protection obligations. Providing the necessary guidance on data privacy compliance depending on the jurisdictions they reside in, the data they process, and the markets in which they trade is where our experts can assist in an efficient and cost-effective way, allowing organisations to focus on their core business activities.”
Is this an area of interest? Tailored training for IT Professionals
The Irish Computer Society provides members with the necessary qualifications, skills and training needed to succeed and excel within the profession.
Upcoming courses which may be of interest include:
- Certificate in Business Analysis – offers academic accreditation for business analysts through the use of proven business analysis techniques. Up to 100% funding available.
- European Certified Data Protection Officer (ECDPO) – This programme has been designed to equip Data Protection Officers with the necessary skills and competencies to meet and maintain all aspects of data protection compliance.
- CDPP – Certified Data Protection Practitioner – Be confident that your organisation’s policies and procedures are legally compliant with data protection legislation by completing Ireland’s first certified data protection practitioner programme.