StandardOS

GDPR: all pages

GDPR · the duties determination

Which GDPR duties apply to you, in writing

Nine questions; the reading cites the provision behind every line, and the duties follow as a table you can copy or download.

Do you process personal data on behalf of your customers, as their processor?

A SaaS that holds its customers' end-user data does; every company is the controller of its own customer and staff data regardless (Article 4(7) and (8)).

Where is the company established?
Does the company employ fewer than 250 persons?

Article 30(5): the threshold for the record-of-processing exemption, which the next question usually takes away.

Is the processing of personal data occasional?

A product in use processes personal data every day, so for a software company the answer is almost always no (Article 30(5), Article 27(2)(a)).

Do the core activities involve regular and systematic monitoring of individuals on a large scale?

Behavioural tracking, profiling for advertising, location tracking, employee monitoring as the product's purpose (Article 37(1)(b)).

Do you process special categories of data, or criminal data, on a large scale?

Health, biometrics for identification, genetic data, sexual orientation, political opinions, religion, trade union membership (Article 9), convictions and offences (Article 10): 37(1)(c), 35(3)(b).

Does the product make systematic and extensive evaluations of individuals by automated means, with legal or similarly significant effects?

Credit scoring, automated hiring decisions, insurance pricing per person (Article 35(3)(a)).

Does the product systematically monitor a publicly accessible area on a large scale?

Video analytics in public space, smart-city sensors identifying people (Article 35(3)(c)).

Do personal data leave the Union, to a sub-processor or a cloud region outside the EEA?

A US-headquartered cloud provider with EU regions still counts where support or backups reach outside (Chapter V, Article 44).

The determination

Answer the first two questions to read the reading for your case; each further answer adds its duty.

Dates, hours and counts are read from the Regulation and the catalogue, never typed on this page. This is a reading, not legal advice.