Official Statement: EU GDPR Compliance
At Mitra Innovation, we are committed to providing our customers with transparency regarding our privacy practices and compliance with European Union (EU) privacy regulations. We value your trust and are dedicated to protecting your privacy.
Our commitment to protecting the privacy of our customer’s data includes:
- Compliance to the EU General Data Protection Regulations (GDPR)
- Having ISO 9001 – Quality Management System
- Working towards ISO27001 – Information Security Management
- Assessment of customer projects at inception to ensure privacy is part of the proposals and designsMitra Innovation supports our customers’ need to be compliant with the new European Union General Data Protection Regulation (“GDPR”) that takes effect on May 25, 2018.
What is the GDPR?
The GDPR is the new European privacy law that replaces the EU Data Protection Directive. The law requires that business protect the privacy and personal data of EU citizens and transactions that occur within EU member states.
What is “personal data”?
Personal data is any data that relates to an identified or identifiable natural person. Examples of personal data includes identifiers such as name, location data, and unique online identifiers.
How has Mitra Innovation been preparing for the GDPR?
The General Data Protection Regulation (GDPR) will become enforceable in the European Union in May 2018. At that time, Mitra will be fully compliant with this regulation. Our teams have been carrying out data audits of our own employee data and have included the same principles with our project assessments. We are also reviewing our entire product suite and business practices to ensure we fully support our customers with GDPR compliance. We understand that personal data is the property of the individual and need to respect their rights as well as being legally compliant.
How can Mitra Innovation customers prepare for the GDPR?
Know where your customers are geographically located: The GDPR applies to EU citizens and transactions that occur within EU member states. Therefore, to ensure that you are compliant with these regulations, you must be able to determine where your customers are located. There are different regulatory enforcement bodies in each member state. Any International transfers need to be covered by any local laws also such as Privacy Shield in the US. If data is transferred or processed outside of the EU or in countries without safeguards then Mitra will look to ensure adequate security and practices are put in place to protect privacy of personal information.
Ensure that appropriate consent is obtained: The GDPR favors the use of opt-in consent mechanisms (explicit consent) e.g. unselected checkbox over opt-out consent mechanisms (implied consent) e.g pre-selected checkbox. Additionally, data subjects (your customers) should be able to withdraw their consent as easily as it was given and have their personal data erased. This does not include information that is required to complete a contract or has a legal requirement, however this needs to be identified and made clear.
Develop data breach response plans when personal data is involved: Organisations should have a clear, defined plan if personal data is breached. The GDPR requires that notice must be provided without undue delay and, where feasible, not later than 72 hours after having become aware of it. Mitra Innovation will notify affected customers without undue delay if we become aware of a data breach of our services.
Hire a Data Protection Officer (“DPO”): The GDPR makes the appointment of a DPO mandatory when the activities of the data controller involve “regular and systematic monitoring of data subjects on a large scale” or where the entity conducts large-scale processing of “special categories of personal data” (such as those revealing racial or ethnic origin, political opinions, or religious or philosophical beliefs). The DPO should have expert knowledge of data protection (privacy) law and practices. In Mitra Innovation we have a Data Protection Lead but as a processor of client data on the whole we haven’t appointed a DPO. Our Data Protection Lead and architects will work with Clients and their DPO’s as required to ensure privacy is protected, breaches are investigated and reported as required, access requests and right to be forgotten requests are complied with in a timely manner.