Privacy law: dealing with data protection regulations

Data protection law is of crucial importance to businesses in the modern (digital) world. Businesses and organisations that process personal data must comply with strict regulations. These regulations are set out in the data protection legislation, the General Data Protection Regulation (GDPR). Data protection laws safeguard individuals’ personal data and regulate how businesses and organisations collect, store and use this data. How do data protection laws work? And which businesses are subject to data protection legislation?

What are data protection laws?

Data protection laws govern everything relating to the protection of people’s personal data: the right to privacy and the right to protection. These rights ensure that people retain (digital) control over their personal data. In the digital world, privacy is a subject that is becoming increasingly important and far-reaching. Privacy legislation is therefore a complex and constantly evolving area of law, subject to ever-increasing requirements and the development of new regulations. Companies must be aware of the legal obligations and strict standards that apply to data protection and ethical responsibility when processing personal data.

What does privacy law cover?

Privacy law encompasses a wide range of topics aimed at protecting personal data and the privacy of individuals. Specifically, privacy legislation stipulates that companies must comply with privacy rules relating to the right to privacy in order to avoid legal sanctions and heavy fines. The best-known component of privacy legislation is the General Data Protection Regulation (GDPR).

General Data Protection Regulation (GDPR)

The General Data Protection Regulation has been in force since 25 May 2018 and replaces previous privacy directives. The GDPR applies to all organisations, regardless of location, that process personal data of EU citizens. The aim of the GDPR is to protect individuals’ privacy and to ensure that personal data is processed in a fair and transparent manner. Organisations that do not comply with the GDPR may face fines running into millions of euros. It is therefore vital for businesses and organisations to adhere to these regulations.

What is permitted and what is not under the GDPR?

What is permitted under the GDPR:

• Organisations may collect personal data, but only for specific, legitimate and justified purposes.
• Companies and organisations must seek consent to process data, and this consent must be freely given, informed and specific.
• Organisations must ensure that the data collected is accurate and up to date.
• Companies and organisations must implement adequate organisational security measures to protect data against loss, theft or unauthorised access.
• Individuals have the right to access, rectify or erase their own data.
• Data transfers between organisations must comply with the GDPR regulations.

What the GDPR prohibits:

• Organisations must not collect personal data without a valid reason.
• Companies and organisations must not use data for purposes other than those for which it was collected.
• Sensitive data, such as race, religion, sexual orientation, etc., may only be processed under strict conditions.
• Data must not be retained for longer than is necessary for the intended purpose.
• Automated decision-making without human intervention is restricted and subject to specific rules.

Other aspects of data protection legislation

In addition to the GDPR, data protection legislation also covers other areas. Important aspects of data protection law include, for example:

Privacy policy: developing a policy to comply with data protection legislation and informing users about how data is processed and used
Data Protection Impact Assessment (DPIA): evaluating data processing to identify and minimise privacy risks
Data Subject Access Requests (DSARs): individuals have the right to access their own data, as well as the right to be forgotten and the right to data portability
Data breach notification (data leaks or data loss): organisations are obliged to report a data breach to the relevant authorities and data subjects if the breach could harm individuals’ privacy

Companies and organisations are expected to comply with laws and regulations to avoid legal sanctions and fines. Furthermore, proper compliance with privacy rules helps to build the trust that customers, consumers and partners have in a company. By actively preventing data breaches and the loss of customer data, and by strictly adhering to privacy law and regulations, serious reputational damage can be avoided.

Why privacy legislation is important for your business

Privacy legislation is essential, as it not only imposes legal obligations but also protects the trust of customers and partners. Your business almost always processes personal data, and as soon as this happens, strict rules apply regarding transparency, consent, security and retention periods. Failure to comply with these rules can lead to heavy fines, liability in the event of data breaches and reputational damage. But just as importantly, a sound privacy policy gives you control over information, prevents operational risks and strengthens your market position.

What to do in the event of a privacy breach?

In the event of a privacy breach, individuals can take various steps. For example, a person can lodge a complaint with the Dutch Data Protection Authority (AP). The AP is the supervisory authority for privacy matters in the Netherlands. In addition, there are various reporting centres for privacy breaches in the Netherlands. In serious cases, an individual may take legal action against the party responsible. If companies receive a request from a data subject to access personal data, they must respond within a specified timeframe (usually one month).

A privacy breach can have far-reaching consequences for a company or organisation. For example, confidential business information may be lost or fall into the wrong hands, and malicious parties may gain access to protected personal data. In addition to fines for breaching privacy legislation – which can be substantial depending on the severity of the breach – a breach of privacy law can lead to lengthy, costly legal proceedings and reputational damage.

What are the most common causes of data breaches?

Data breaches often arise from relatively simple mistakes, such as accidentally sending sensitive information to the wrong email address or storing personal data unsecured in the cloud. Poor password management, outdated software or inadequately secured systems are also common causes. These are an open invitation for hackers to gain access. Our advice is therefore to ensure a solid foundation comprising both technical security and awareness within your organisation. Fruytier helps you identify risks, draw up policies and respond quickly and in a legally compliant manner in the event of incidents.

Safeguarding privacy: be proactive and vigilant

Safeguarding privacy requires organisations to adopt a proactive approach. Any organisation wishing to comply with the GDPR and prevent data breaches or privacy violations would do well to raise awareness. Ensure that all staff are aware of privacy legislation and the importance of data protection. Identify what information is collected, where data is stored and who has access to this data. It goes without saying that, under data protection law, explicit consent from data subjects is required for the data being collected.

What can a data protection lawyer do for you?

Data protection law has changed enormously in recent years. Take, for example, the exchange of personal data between Europe and the United States. And with the rapid pace of current developments, for instance in the field of artificial intelligence (AI) and the shift to the cloud, this area of law is becoming ever more complex and extensive. A data protection lawyer at Fruytier Lawyers in Business can provide you with (proactive) assistance in various areas.

We help businesses and organisations to understand and comply with data protection legislation through compliance support and advice, the drafting of privacy policies, as well as by supporting clients in the event of a data breach and in legal matters. We are happy to answer your questions and advise you on identifying appropriate measures from various perspectives. For more information, please contact a privacy law solicitor at Fruytier Lawyers in Business directly to receive legal advice with no obligation.

Frequently asked questions on privacy law

Which law governs data protection?

Data protection is governed by the General Data Protection Regulation (GDPR). The GDPR is a European regulation that governs the protection of personal data and the right to privacy within the European Union. Data protection law requires companies to comply with strict regulations regarding the collection, processing and management of personal data.

When does my business need to comply with the GDPR?

Your business must comply with the GDPR as soon as you process personal data relating to customers, employees, suppliers, website visitors or other individuals. This applies even to ordinary business activities such as storing customer data, sending out newsletters, processing job applications, using CCTV footage or maintaining staff files. The GDPR does not apply only to large organisations: SMEs, online shops, service providers and self-employed individuals may also be subject to the privacy rules.

What constitutes personal data under the GDPR?

Personal data is any information that can be directly or indirectly linked to a natural person. This includes names, addresses, email addresses, telephone numbers, customer numbers, IP addresses, location data, employment details, photographs and online identifiers. Business contact details may also constitute personal data if they refer to an individual, such as the email address of an employee or contact person.

What is meant by the processing of personal data?

Processing is a broad concept. It encompasses virtually any operation involving personal data, such as collecting, storing, organising, consulting, using, sharing, modifying, securing, erasing or destroying it. A company is therefore already processing personal data when it enters customer details into a CRM system, stores invoices, assesses job applications, analyses visitor statistics or shares data with a software supplier.

Does my business always need consent to process personal data?

No. Consent is just one of the legal bases under the GDPR. In many business situations, processing may also be based on the performance of a contract, a legal obligation or a legitimate interest. Consent must be freely given, specific, informed and unambiguous. It is therefore important for businesses to document, for each instance of processing, the legal basis on which the processing is carried out.

What should a privacy notice contain?

A privacy notice must clearly explain what personal data your company processes, for what purposes this is done, on what legal basis, how long data is retained, with whom data is shared, and what rights data subjects have. It must also state how a person can submit a request, for example to access, correct or delete personal data. The privacy notice must be easy to understand and easy to find, for example on the website.

When does my business need a data processing agreement?

A data processing agreement is required when a third party processes personal data on behalf of your business. Examples include a payroll administrator, cloud provider, CRM supplier, hosting provider, IT administrator, email marketing platform or accounting software. The agreement sets out arrangements regarding, amongst other things, security, confidentiality, sub-processors, data breaches and the deletion or return of data once the service has been provided.

What is a data breach and when do I need to report it?

A data breach is a security incident in which personal data is lost, or is accessed, altered, disclosed or made accessible without authorisation. Examples include an incorrectly addressed email containing personal data, a stolen laptop, a hacked system or unsecured cloud storage. In certain cases, a data breach must be reported to the Dutch Data Protection Authority within 72 hours. If the data breach is likely to pose a high risk to those affected, the individuals concerned must also be informed.

What rights do customers, employees and other data subjects have?

Under the GDPR, data subjects have various rights, including the right to information, access, rectification, erasure, restriction of processing, data portability and the right to object to certain processing activities. In some cases, they may also object to automated decision-making. If your company receives a GDPR request, you must, in principle, respond to it within one month.

How long is my business allowed to retain personal data?

Personal data must not be retained for longer than is necessary for the purpose for which it was collected. Statutory retention periods apply to certain types of data, such as tax-related record-keeping obligations. For other types of data, your company must determine and set out an appropriate retention period itself. For example, recruitment data, customer data, marketing data and CCTV footage each require their own retention policy.

What does the processing of personal data involve?

The processing of personal data refers to any operation or set of operations performed on personal data – from data collection and recording to the dissemination, protection and erasure of data. Examples of these operations (activities) in everyday practice include recording information about individuals, storing data in databases, analysing data and sharing data with other parties. When processing personal data, the principles of data protection (GDPR) must be complied with at all times.

What is special category personal data, and is my company permitted to process it?

Special category personal data refers to sensitive data, such as data relating to health, racial or ethnic origin, religion, political opinions, biometric data, genetic data, trade union membership or sexual orientation. In principle, the processing of such data is prohibited, unless a specific exception applies. For businesses, this may arise, for example, in relation to employment law cases, absence management, medical data, access control or identity verification.

What does my company need to arrange when using US software or cloud services?

If your company uses software, cloud storage or other services involving the processing of personal data outside the European Economic Area, you must check whether the data transfer complies with the GDPR. When transferring data to the United States, the EU-US Data Privacy Framework may be used subject to certain conditions, but not every supplier is automatically covered by it. Additional contractual arrangements, security measures and an assessment of the data flows are often required.

Can my company use personal data for direct marketing?

Personal data may only be used for direct marketing if there is a valid legal basis for doing so and the data subjects have been clearly informed. In the case of email marketing, rules on electronic communications and consent apply in addition to the GDPR. Existing customers may, subject to certain conditions, receive commercial emails about similar products or services, but they must always be able to unsubscribe easily.

When is a Data Protection Impact Assessment mandatory?

A Data Protection Impact Assessment, also known as a DPIA, is mandatory when processing is likely to pose a high privacy risk to data subjects. This may be the case, for example, with large-scale monitoring, the processing of sensitive data, CCTV surveillance, profiling, AI applications or automated decision-making. A DPIA enables your organisation to identify privacy risks in advance and determine what measures are necessary.

What are the consequences if my business breaches the GDPR?

Breaching the GDPR may result in enforcement action by the Dutch Data Protection Authority, including warnings, binding instructions, processing bans and fines. In addition, data subjects may claim compensation, and a data breach or privacy infringement may result in reputational damage, a loss of customer trust and commercial loss. For businesses, privacy compliance is therefore not only a legal obligation but also a key part of risk management.

How can a data protection lawyer help my business?

A data protection lawyer can help your business assess privacy risks, and draft or refine privacy notices, data processing agreements, data breach procedures, data retention policies and internal GDPR documentation. A solicitor can also advise on data breaches, complaints from data subjects, enforcement by the Dutch Data Protection Authority, international data transfers, AI applications and contracts with IT or cloud service providers.

Privacy law solicitors

Our privacy law team comprises the experienced privacy law solicitors listed below. They respond swiftly and help you make the right decisions in a timely manner. In the event of a (potential) data breach, acting swiftly is of the utmost importance. In such cases, do not hesitate for a second to contact one of our specialists.