The organization should begin by identifying what personal data it has, its origin and who it shares with them. It may be necessary to perform a survey of the existing data in the entire organization or in specific areas of the organization.

The RGPD, in addition to requiring a record of personal data processing activities, extends the rights to protect personal data for a networked world.

For example, if an organization verifies that you have incorrect personal information you will need to inform third parties with whom you have shared this data so that they can correct their own records, which can only be done if they know the personal information they have, its origin, sharing.

The organization will therefore have to trace the course of personal data, which in turn will facilitate compliance with the principle of accountability in the RGPD, which requires organizations to be able to demonstrate to data protection authorities and that all personal information is safe, for example through effective policies and effective procedures.

In time of the RGPD implementation it is convenient to review the privacy policy, and if necessary make the necessary changes.
In addition to the disclosure of your identity and the purposes for which the organization collects the data, through the usual privacy policy, the RGPD requires disclosure of other requirements when collecting personal data, such as the lawful basis for processing such data, the retention period and the information that individuals have a right to complain to the CNPD if they disagree with the way the organization is handling their data.

The RGPD requires the information to be provided in clear, easy-to-understand and concise language.

The organization should check its procedures in order to guarantee all the rights individuals, including the right to delete their personal data or its free availability in a commonly used digital format.

The GDPR includes the following rights for individuals:

• the right to be informed;
• the right of access;
• the right to rectification;
• the right to erasure;
• the right to restrict processing;
• the right to data portability;
• the right to object; and
• the right not to be subject to automated decision-making including profiling.
• The right to data portability only applies: to personal data an individual has provided to a controller;
• When processing is based on the individual’s consent or in the fulfill of a contract;
• when processing is carried out by automated means.

The organization should update its procedures of handling requests, accordingly the new rules:

•  In most cases you will not be able to charge for complying with a request.
• Requests must be comply within one month.
• Requests can be refused or charged for they are manifestly unfounded or excessive.
• In the case of a refusal of a request, it must be

justified and inform the individual that it has the right to complain to the supervisory entity or to the judicial appeal.

The organization must assess the need to implement a system for verifying the age of the individuals and obtaining the consent of the parents holding the parental responsibility of the child.

For the first time, RGPD provides special protection for children’s personal data, particularly in the context of commercial Internet services that include social networks. The RGPD sets the age at which a child can give his or her own consent in 16 years, although in Portugal the draft law provides for the reduction of this limit for 13 years. Before the age of 13, consent shall always be given by the holder of parental responsibility.

This could have significant implications if the organization offers services to children online and collects their personal data, since consent has to be verifiable and that when collecting children’s data the privacy policy should be written in language that children can easily understand.

It has always been a part of good practice to adopt a privacy-by-project approach and conduct a privacy impact assessment as part of this same project.

The RGPD now makes it mandatory to respect the principles of data protection from the design and protection of data by default, imposing in certain circumstances the evaluation of the impact of data protection – DPIA

A DPIA will be required in situations where data processing is likely to result in high risk for individuals, for example:

• where a new technology is being deployed;
• where a profiling operation is likely to significantly affect individuals; or
• where there is processing on a large scale of the special categories of data.

If a DPIA indicates that data processing is of high risk and the organization, whether by available technology or the associated costs, does not feel able to minimize such risks, it should consult the CNPD on the compliance of the processing operation with the RGPD.

The organization should therefore assess the situations in which a DPIA will be required. Who’s going to do that? Who needs to be involved? If the process will be performed internally or outsourcing?

The organization should also consult the guidelines of the CNPD as well as those of the Article 29 Working Party of Directive 95/46 / EC, and find out how to implement it better in the organization.