The German data protection authorities are currently coordinating their activities on the interpretation of the GDPR and publishing them in brief papers.
The first three DSK papers dealt with the following topics:
- records of processing activities
- powers/administrative fines
- processing of personal data for advertising purposes
Paper No. 4 discusses the data transfer to third countries for which the GDPR provides the following options:
- specification of the adequacy of the data protection level in the third country by the EU Commission (Art. 45 GDPR)
- existence of appropriate safeguards (Art. 46 GDPR) or
- derogations for specific situations (Art. 49 GDPR)
Four additional DSK papers on the GDPR were published recently, focusing on the following topics:
- data protection impact assessment
- right to access
- territorial scope
- action plan
The paper for an action plan related to the GDPR for companies is of particularly interest. The data protection supervisory authorities consider many companies to be unprepared for the GDPR and their effects on the business processes, which is why they compiled some tips for companies on how to prepare an action plan.
The current papers no. 4 to no. 8 are available at: https://www.lda.bayern.de/en/privacy_eu.html.