{"id":544,"date":"2020-02-14T16:48:02","date_gmt":"2020-02-14T15:48:02","guid":{"rendered":"https:\/\/www.actonic.de\/4-easy-questions-to-check-if-you-are-fully-gdpr-compliant\/"},"modified":"2025-07-22T17:12:09","modified_gmt":"2025-07-22T15:12:09","slug":"4-easy-questions-to-check-if-you-are-fully-gdpr-compliant","status":"publish","type":"post","link":"https:\/\/actonic.de\/en\/4-easy-questions-to-check-if-you-are-fully-gdpr-compliant\/","title":{"rendered":"4 easy questions to check if you are fully GDPR compliant"},"content":{"rendered":"

[vc_row][vc_column][vc_column_text css=””]<\/p>\n

Basic idea of GDPR<\/h2>\n\n

The idea behind the GDPR<\/a> <\/strong>is quite simple: it is meant to give EU citizens the right to know and decide how their personal data is being collected, stored, processed, protected and deleted. Simple as it may sound, the regulation sets a very high standard and many companies find themselves struggling trying to comprehend its requirements and put all the necessary systems and processes in place.<\/p>\n\n

However, non-compliance may result in hefty fines (up to 4% of annual global turnover), high legal costs and significant reputational damage. Therefore, we believe it is high time we all understood what the GDPR entails and took the steps to ensure compliance.<\/p>\n\n\n

Who is affected?<\/h3>\n\n

If you are wondering whether you are affected at all, then the answer is probably yes. Regardless of where your company is based, the regulation affects you if you supply goods or offer services to EU citizens or companies.<\/p>\n\n\n

Key elements of the GDPR<\/h3>\n\n

First of all, let’s examine the main elements of the GDPR in more detail.<\/p>\n\n\n

1. Personal data<\/h3>\n\n

Personal data<\/a><\/strong> is any information relating to an identifiable person, which can be used to directly or indirectly identify this person. It includes name, surname, address, email address, phone number, Social Security number, IP address, medical and biometric data, etc.<\/p>\n\n\n

2. Consent<\/h3>\n\n

The conditions for consent have also been strengthened. According to Article 4(11), consent should be \u201cfreely given, specific, informed and unambiguous”. In other words, your request for consent should be easily accessible, intelligible and state the purpose of collecting data in plain language. It must also be as easy to withdraw as it is to give. For more information, see Be GDPR compliant: everything you need to know about getting consent in Jira and Confluence<\/a><\/p>\n\n\n

3. Pseudonymization<\/h3>\n\n

It means that personal data must be obscured or anonymized so that it cannot be traced back to a person without additional information.<\/p>\n\n\n

4. Right to be informed<\/h3>\n\n

Data subjects have the right to be informed that their personal data is being collected and processed. You must also provide privacy information to the data subject at the time you collect their data (for the full text, see Article 13<\/a>).<\/p>\n\n\n

5. Right to access<\/h3>\n\n

It means that data subjects can obtain information as to whether or not their personal data is being processed, the purposes of the processing, the period for which the data will be stored, the recipients to whom that data has or will be disclosed, etc. (for the full text, see Article 15<\/a>).<\/p>\n\n\n

6. Right to be forgotten<\/h3>\n\n

It entitles the data subject to have the data controller erase their personal data without undue delay (for the full text, see Article 17<\/a>). Now, this rule might be tricky to implement – on the one hand, you have to erase all the personal data completely, on the other hand, you don’t want to run the risk of losing valuable data which may be associated with the user, as data subjects are not just your customers, but also your employees. With our solution,  Data Protection and Security Toolkit for Jira and Confluence<\/strong><\/a>m you can use simple JQL queries to anonymize personal data across Jira<\/a><\/strong> and Confluence without having to delete important information.<\/p>\n\n\n

7. Breach notifications.<\/h3>\n\n

Breach notifications are now mandatory. It means that you must report all breaches to data subjects and supervisory authorities within 72 hours of becoming aware of the breach (for the full text, see Articles 33<\/a> and 34<\/a>).<\/p>\n\n\n

It is getting serious<\/h3>\n\n

Ensuring compliance may be challenging, especially for smaller companies which might not have sufficient resources or expertise to handle all the requirements. In fact, many research reports show that a lot of companies are still not fully compliant. However, the stakes are getting high.<\/p>\n\n

Some examples<\/span><\/p>\n\n

Google<\/strong><\/p>\n\n

We all remember the high-profile case of Google, an American technology giant, which was fined<\/a> 50 million EUR at the beginning of 2019 for not properly disclosing to its users how their personal data is collected and stored across its services.<\/p>\n\n

British Airlines<\/strong><\/p>\n\n

Later this year British Airlines were fined a record \u00a3183.39 million<\/a> (1.5% of the company’s total revenue for 2018) following the data breach that took place the previous year. British Airlines were accused of poor security arrangements, which led to the leak of sensitive personal data, including credit card details and personal addresses, of hundreds of customers.<\/p>\n\n

\u00d6sterreichische Post AG<\/strong><\/p>\n\n

More recently, \u00d6sterreichische Post AG, an Austrian post company, had to pay 18 million EUR<\/a> for creating and selling a register containing personal data of millions of Austrian customers.<\/p>\n\n

Deutsche Wohnen SE<\/strong><\/p>\n\n

Deutsche Wohnen SE, a German real estate company, are also being fined for failing to provide an archiving solution that would allow for the erasure of the data that was no longer necessary. The imposed fine<\/a> amounts to 14.5 million EUR, which constitutes 2% of the company\u2019s annual turnover).<\/p>\n\n

As you see, the new legislation is going to affect everyone. Of course, you can have your fingers crossed and hope that your company will never be checked (which, we believe, is wishful thinking), or you can have your back covered with a useful tool for Jira and Confluence. See how it works in our YouTube video<\/a>.<\/p>\n\n\n

Check yourself \u2013 4 GDPR-questions<\/h3>\n\n

If you are not sure of your regulatory compliance status, you can check it by answering the simple questions below:<\/p>\n\n\n