Člen 3 SUVP (GDPR). Ozemeljska veljavnost
[…]
2. Ta uredba se uporablja za obdelavo osebnih podatkov posameznikov, na katere se nanašajo osebni podatki in ki so v Uniji, s strani upravljavca ali obdelovalca, ki nima sedeža v Uniji, kadar so dejavnosti obdelave povezane:
(a) z nudenjem blaga ali storitev takim posameznikom v Uniji, ne glede na to, ali je potrebno plačilo posameznika, na katerega se nanašajo osebni podatki, ali
(b) s spremljanjem njihovega vedenja, kolikor to poteka v Uniji.
[…]
(EN) ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27002, section 6.1.1.
Here is the relevant paragraph to article 27 GDPR:
6.3.1.1 Information security roles and responsibilities
Implementation guidance
The organization should designate a point of contact for use by the customer regarding the processing of PII. When the organization is a PII controller, designate a point of contact for PII principals regarding the processing of their PII (see 7.3.2).
The organization should appoint one or more persons responsible for developing, implementing, maintaining and monitoring an organization-wide governance and privacy program, to ensure compliance with all applicable laws and regulations regarding the processing of PII.
[…]
Anmelden
to read full text