The entry into force of the General Data Protection Regulation 2016/679 (EU), also known as “GDPR” or “GDPR”, in combination with the national law N.4624/2019 and the Directives, Decisions and Opinions of the Personnel Data Protection Authority Character, they form part of the existing legislative framework, with which every company that, in the exercise of its activities, collects and processes personal data must comply.

“Personal data” means any information relating to an identified or identifiable natural person. For example, personal data means the name, surname, home address, age, profession, VAT number, etc. of a natural person, and businesses generally collect personal data of their customers, partners and employees.

“Sensitive personal data” are those that reveal racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as the processing of genetic data, biometric data for the purpose of unambiguous identification of a person, data that concern health or data concerning a natural person’s sexual life or sexual orientation.

The legislation for the protection of personal data introduces new, increased requirements and obligations, to redesign the procedures, in order to comply with the new data. Compliance with the legislation for the protection of personal data (GDPR) is now a matter of utmost importance, as any violation of it can lead, in addition to the imposition of heavy administrative fines of up to 10 or even 20 million euros (depending on the severity of the violation) , criminal sanctions, compensations, legal battles, etc., to the damage of the Customer’s reputation and to the distrust of the consumer public, regarding the legal and safe processing of their personal data.

The legislation on the protection of personal data concerns any company or body, public or private law, that either maintains an establishment within the European Union (EU), or processes personal data within it (the Union) for the offer of goods and services or the monitoring of their behavior.

DPO Service Description

The appointment of a Data Protection Officer (DPO) is a cornerstone in ensuring ongoing compliance with GDPR. The DPO assumes a leading role in matters of privacy and protection of personal data, providing its services both remotely and with on-site visits to the Client’s premises. In particular, according to Article 39 of the GPDR, the DPO:

• informs and advises the Customer, who acts either as a controller or as a processor and employees, regarding their obligations as derived from the legislation for the protection of personal data,
• monitors the Client’s compliance with the legislation on the protection of personal data and with the Policies and Procedures it has adopted in relation to the protection of personal data, including the delegation of responsibilities, awareness and training of employees who participate in the processing operations, as well as the relevant controls,
• provides advice, when requested, regarding the data protection impact assessment and monitors its implementation,
• collaborates with APDPH,
• is the contact person with the Data Protection Authority for issues related to data processing, including prior consultation and consults, as appropriate, on any other matter,
• monitors and reports on ongoing compliance and good practice in the organization’s management of data protection issues, in the context of ongoing legal and regulatory developments.

Necessity-Obligation to Appoint a DPO

In accordance with the General Data Protection Regulation (GDPR) 2016/679 (EU), certain entities are required to appoint a Data Protection Officer (DPO). These bodies are:

• Public Authorities or bodies, except courts acting within their jurisdiction,
• Organizations whose core activities require regular and systematic monitoring of personal data on a large scale,
• Organizations whose main activities involve large-scale processing of sensitive personal data.

The DPO is appointed on the basis of professional qualifications and in particular on the basis of his expertise in the field of data protection law and practices, as well as on the basis of his ability to fulfill his duties.

Revival’s DPO service allows the Client to ensure ongoing compliance with data protection legislation while continuing to focus on their core business. In addition to maintaining regulatory compliance, the DPO service helps enhance security and productivity, manage risk, and bring cost benefits.

The piecemeal application of technical and organizational measures for the protection of personal data is considered ineffective if it is not accompanied by the continuous supervision of the correct application and the updating of the procedures, which will be undertaken by the Data Protection Officer. Therefore, the services of a well-qualified DPO offer high added value to any business, whether its appointment is considered mandatory or is the result of a voluntary choice.

The Competitive Advantage of Revival

Revival’s DPO as a service is provided by a team of qualified and experienced executives, characterized by:

• Excellent knowledge of the existing legal framework for the protection of personal data, specifically the GDPR,
• Information security knowledge and skills,
• Knowledge of how to implement the tripartite Confidentiality, Integrity and Availability,
• Excellent understanding of risk management and risk assessments,
• Excellent understanding of compliance standards,
• Ability to coordinate and advise on data breaches and their notification to the supervisory authority (DPA),
• Ability to coordinate the security incident response process,
• Immediate response to the Customer’s requests-questions,
• Continuous monitoring of the evolving scientific dialogue on personal data protection issues at national and international level,
• Experience in providing DPO services, to private and public sector clients.