Prepare
your

start-up
for
the
GDPR
Step-by-step with
WeControl
 Step
1:
What
is
your
data
protection
objective?
Data protection is risk management for personal data.

What will you do if

What will you do if
What will you do if What will you do you lose a device
someone asks for containing access to
your data is when you hire a
copies of their personal data?
hacked? new employee?
personal data?
Step
2:
Appoint
a
data
protection
owner
You may be start-ups, but people
still need to own tasks.
 Step
3:
Create:

Privacy
Policy Cookie
Notice
Step
4:
Maintain
records
of
processing
activities
(ROPA)
Maintaining ROPA is mandatory and
it is the key to unlock the GDPR in
your start-up.

NOTE :
any
interaction
between
your
start-up
and
3rd
party
must
have
a
GDPR
compliant
contract!
Step
5:
Check
your
third-party
vendors
are
compliant
Make sure that all your Processors and
are GDPR compliant.
Step
6:
Dealing
with
personal
data
incidents
A data incident is any event that compromises personal data: loss,
sent to the wrong person, denial of service, accidental deletion, etc.

If
you
don't
deal
with
this,
the
consequences
can
be
very
serious!
Step
7:
Respect
individuals’
GDPR
rights
You must have a mechanism to
capture and process individuals`
rights requests

You have 30 days to respond to a

SAR

The individual has the right to

access, get copies of, delete and
modify his / her personal data and
to object to certain types of
processing
Step
8:
Training
and
physical
security
You must train your employees
about data protection.
Step
9:
Sales
and
Marketing
You must ask for and record
consent before you send
marketing material

Always have an opt-out button

You must be very transparent

about your marketing
Step
10:
Human
Resources
(HR)
Add a data protection
section to your
employment rules
Give access only to those
who need it
Thank
you!

Wecontrol.io
hello@wecontrol.io
Tallinn,
Estonia