Privacy compliance

GDPR-compliant apps

The development of mobile applications (Apps) always involves the processing of personal data.

Apps require personal data from their users. Often processing of personal data takes place on a widespread basis due to the close interaction of the app with the operating system, which allows access to more data than a traditional browser. 

Applications are able to collect large amounts of data from the user’s device and to process them to provide new and innovative services.

It is therefore necessary to set up proper personal data processing from the very beginning, following the principles of privacy by design and by default. Indeed, the GDPR requires the protection of data from the moment in which a new product or service is designed and by default. 

There must always be a proactive attitude of the data controller in determining the technical and organizational measures to adopt in order to ensure adequate protection of personal data. 

We assist the Client right from the preliminary ‘planning’ phase, because it is essential to determine from the very beginning the risks involved in the data processing and to determine the necessary measures to adopt in order to implement the data protection provisions and principles. 

After a preliminary analysis, we assist the Client in the preparation of all the management documents and information necessary to be able to place the App on the market safely and without infringing the involved rights. 

Privacy Consultancy is essential for every company

Privacy consultancy is essential for every company because it involves several business aspects such as facing disputes, audit by the Italian DPA or legal action promoted by a person who claims the infringement of his/her rights. 

In all these cases, it is necessary to contact a professional expert in the field of personal data processing to obtain the right advice and avoid an irreparable compromission of the situation. 

However, consultancy is even more important as a preventive measure, to avoid actions or disputes that may be costly.       

Every choice concerning the processing of personal data must be well balanced and assessed in light of the fundamental principles established in EU Regulation 679/2016 of minimisation, limitation, lawfulness, fairness, transparency, accuracy, integrity and confidentiality.

Even after the entire organization has been adapted, the use of new technologies or the identification of a new processing may require a new analysis of the measures already adopted or that have to be adopted. Experience and expertise allow us to assist the Client for every need and to support him/her in every decision whenever personal data are involved.

We offer our consultancy: 

• in the preliminary evaluation phase of a project.      
• in the privacy compliance of the entire company.     
• in the privacy compliance of a single process.     
• in the examination of specific situations or in the resolution of particular critical issues.

We provide legal support and defense in the event of administrative actions, such as the Complaint to the Italian DPA or the defense of the Client in the context of any investigations launched by the competent Authority.

We also assist Clients in judicial proceedings, both in an active sense – as promoters of actions against third parties – and in the defensive phase – when it is necessary to resist a contestation or a claim for compensation.

Privacy Audits? Not just a formality

Audits should be systematically scheduled, in order to verify and be able to prove to the Control Authority that the organizational structure performs a constant monitoring process of the procedures adopted, internal changes and technological evolution. 

The scheduling of audits is not only relevant for the management of personal data, but also for the purposes of the law on the administrative liability of institutions. 

Audits, including inspections, may be carried out by the owner. It is often advisable to entrust it to an external specialist, who is familiar with the legislation on personal data processing and who objectively evaluates the internal procedures. 

The verification of the adopted measures involves both the internal organization of the company (internal audit) and the organization through external professionals acting as Data Processors (external audit).

The internal audit is carried out within the organization and it is part of the internal control system. It represents one of the tools used to check that activities are carried out correctly and to verify that procedures are observed and adequate. 

External audits, on the other hand, are carried out outside the company, i.e. by third parties to whom a part of the processing has been delegated, and it may be of two types.

The first type, and also the strictest one, includes those audits that are carried out before a relationship for the service provision is established.

In fact, before choosing a supplier who will process data on our behalf, it is necessary to verify that it meets the requirements and guarantees set out in the GDPR, both to protect company’s and partners’ data, and to avoid sanctions. 

The second type of Audit takes place after the assignment has been conferred and it is aimed at verifying the correct fulfillment of the contract instructions as well as the compliance with the privacy regulation. 

At the end of the Audits, it is possible to determine the ‘conformity’ or ‘nonconformity’ of the concrete processing with regard to the chosen organizational model. After that, indications can be given to establish the best possible level of compliance. 

Privacy compliance and facsimile: no thanks!

Too often, privacy compliance is downplayed and dealt with superficially by using facsimiles or templates. 

In the light of the above, it is clear that privacy cannot be ‘standardized’. Each complying procedure is different from the other, so each company will be assisted directly and specifically by Studio Turini in order to realize a customized adaptation.