One of the first steps companies must take to prepare their data at rest for GDPR compliance is to become aware of the way sensitive data is handled internally. This implies a deep understanding of EU data subjects’ rights as well as the principles enshrined in GDPR that relate to the processing of personal data.
Under GDPR, sensitive information must be processed in a transparent way, its use limited to the purpose for which the consent was initially granted and stored only for the amount of time needed for the purpose for which the data was processed. Sensitive information must also be protected against unauthorized or unlawful processing and against accidental loss, destruction, or damage through the use of appropriate technical and organizational measures. Data subjects can also revoke consent at any time and request that their data be deleted through the right to be forgotten.
What all these requirements mean in practice is that companies must know where sensitive data is located, who is processing it, and exercise control over it at all times. Find out more.