POLICY ON PERSONAL DATA PROTECTION
[company]

Purpose

The purpose of the policy on personal data protection is to define how we process personal data. Personal data processing covers any use of personal data such as collection, registration, curation, storing, transmission, grouping or pooling, containment, deletion or destruction. Personal data is to be perceived as any information that may be used to verify the identity of a person including (but not limited to) first-name, surname, address, email address or other contact information regardless of said information relates to the private residence or workplace of the individual in question.

The processing of personal data must be in accordance with existing laws regarding the protection of personal data, among these the joint EU regulation in the EU General Data Protection Regulation and such as the regulations described in this policy.

Violation of the policy on personal data protection may have serious consequences for [Company], and failure to comply with this policy is considered a violation of the terms of employment.

Basic principles

This policy applies equally to all our units processing personal data. The rules for processing personal data apply both to electronic and the physical handling of such information.

When handling personal data, we are obligated to comply with the following basic principles:

Qualification of use:

Personal data is solely collected for the lawful purpose explicitly stated.

Be aware that personal data may only be employed for the same purpose to which they have been collected and which has been stated in advance.

It is prohibited to reuse personal data for any other purpose.

Legality, reasonableness and transparency:

Personal data must be processed legally, reasonably and in a transparent manner in relation to the registered party.

Minimization of data:

No more personal data may be collected than what is deemed appropriate and necessary in correlation with the purpose to which it is collected.

Accuracy:

Personal data collected must be accurate and kept up to date if necessary.

Storage limitation:

Personal data must not be stored for a longer period of time than what is necessary to serve the purpose to which the data has been collected for.

Integrity and confidentiality:

Personal data must be processed in a manner to secure adequate data security using appropriate technical and organizational precautionary measures so as to avoid unauthorised or illegal processing, accidental loss of data or any destruction or damage.

Responsibility:

We [Company] may at any time be required to demonstrate documentation that the above set of rules are being observed and complied with.

This policy forms the basis for company rules to adhere to.

Basic policy for the processing of personal data

As a general rule, personal data may not be processed unless there are valid reasons to do so.

The most commonly applied grounds for data processing are:

The individual in question has given consent to our handling of the personal data.

Our processing of the personal data is necessary to complete an agreement the individual in question is a part of, or has requested that be done prior to entering into an agreement.

Processing the data is a necessity to comply with a legal obligation.

As a rule, consent to the storage of personal data will be required in the examples stated under paragraph 3.2 unless a contractual relationship exists.

Further requirements of the law apply when processing sensitive information. Such include information about race or ethnicity, political persuasion, religious or philosophical persuasion, union membership and information regarding health or sexual preference.

As a rule, processing sensitive information requires consent.

Duty to inform about personal data registration

We have an obligation to inform that we keep and process personal data.

When personal data is collected this must be evident unless the registered party is already familiar with the data collection or if a legal reason exists that allow us to refrain from informing about the data collection.

As a rule, our duty of information is met in the following ways:

We actively inform customers, business associates and other company stakeholders in writing that we process personal data. Terms and conditions relating to our processing of personal data can be found in the privacy policy stated in greater detail on our website.

We actively and in writing inform employees that we process their personal data. For more detailed terms and conditions for the processing of personal data we refer to the employee manual and our privacy policy, both of which are available for employees on our website.

Storage period

Personal data collected may be stored only as long as it serves the stated purpose.

Specifically this means that personal data may be stored as long as a relation to the registered customer or business partner still exists. Personal data must be deleted within reasonable time from the termination of this relation.

The storage period allowed for personal data is described in more detail in our Policy on Storage and Deletion. At the expiration of the storage period allowed, all relevant information must be deleted or destroyed without undue delay.

We are obligated to ensure that our personal data is correct and continuously brought up to date. Incorrect, inadequate or antiquated personal data must be corrected.

Use of data processors

Access to personal data is given to third parties only if guaranteed that the information is handled legally and following the necessary precautions.

A third party may not be labeled data processor or given access to personal data until a Data Processing Agreement is signed. A data processor may be a physical person or a legal entity, a public authority, an institution or other type of public body processing personal data on our direction.

The Data Processing Agreement imposes the data processor with appropriate technical and organizational precautionary measures to protect our personal data as well as condition that the processing of personal data may only be done on our direction.

If services are provided at a third party (such as Cloud Computing Services) it must be investigated whether any personal data is being processed by an additional third party on behalf of the third party providing the service for us, and if this additional cooperative relationship could entail the transfer of our personal data to a non-EU country. In both the above instances it must be secured in contract that the necessary precautionary measures for data protection are taken.

Transfer of personal data to non-EU countries

Whether the recipient is in-house or external, our personal data may only be transferred to recipients outside of the EU if all conditions for such a transfer are met.

Precautionary measures

We have introduced a number of physical, technical and organizational precautionary measures to ensure our personal data from loss or damage, unauthorised alterations and unauthorised access and misuse.

The minimum standard for precautionary measures can be found in our policy on IT-security.

As employee, some examples of precautionary measures to be aware of are:

To prevent unauthorised individuals from gaining access into our IT-systems through the use of passwords and other types of access control.

Ensure that individuals with access to our IT-systems do not gain access to any personal data outside the sphere of their granted area of responsibility.

Ensure that the transfer of personal data through the internet cannot be read, copied, modified or deleted without authorization.

Ensure appropriate logging of user access and attempted access into IT-systems.

Ensure that data processors are used only in accordance with the directions stated by us.

Ensure that personal data is protected from unwanted destruction or loss.

Ensure that personal data is not stored any longer than necessary.

IT systems administration

We have appointed an IT systems administration responsible for continuous compliance with the policy on personal data. The IT systems administration reports directly to our board of managers in regards to the compliance with rules for the protection of personal data.

The purpose of the IT systems administration is to provide continuous information and advice on the Act on Processing of Personal Data and the regulations herein, and also to act as a contact to the Danish Data Protection Agency and to alert the Data Protection Agency in case of data breach while also working to maintain a system responsive to enquiries from registered parties.

Enquiries from registered parties and insight to own personal data

All enquiries from registered parties including requests for data access, demands for correcting information or demands to have data deleted, must be passed on to the IT systems administration with the responsibility to register any enquiry immediately.

Registered individuals are entitled to have access and insight to the data registered if such an enquiry is made in writing.

Written enquiries from registered individuals must be replied within 30 days. The IT systems administration is responsible for accommodating such requests but everyone is obliged to help make sure that enquiries and deadlines are observed.

Reporting data breach

If breach of personal data is suspected, the IT systems administration must be alerted and briefed of the incident immediately. The incident can be reported by email to [[email protected]], or by telephone at [phone number].

The IT systems administration investigates all reported events to verify whether a breach of personal data security has taken place. If a breach is confirmed the IT systems administration will follow a set procedure dependent on the type of information and the extent of the breach.

Impact analysis

It is the responsibility of the IT systems administration to conduct impact analysis (DPIA) on all new and/or revised ways of processing personal data that holds great risk.

For the above reason the IT systems administration must be informed if new personal data is being collected by the company.

As part of their work description, the IT-department employees must cooperate with the IT systems administration to assess the consequences for personal data protection in light of new technology.

If you estimate that the activities and assignments undertaken by your apartment require a certain or new use of personal data, an enquiry must be made to the IT systems administration.

Compliance surveillance

The IT systems administration must continuously and at least once per year, conduct an assessment of the relevant parts of the organization to ensure a satisfactory level of compliance is met in accordance with existing laws.

Compliance among other things cover:

Existing policies including distribution of responsibility, general awareness and employee training.

Exactitude of the stored personal data.

The IT systems administration must device a time schedule in cooperation with key staff members for the remedy of any system flaws within a fair and well-defined time frame.

Related documents

Below is a list of documents relating to this policy and referred to in the above rules:

Policy on Storage and Deletion

Policy on IT-security

Procedure for breach of data by form

This document was updated: [Date]