Data protection

Scope of the Data Protection service

The legal advice on data protection that a law firm can offer its clients includes assistance and advice on all matters related to the processing of personal data. From the identification of the processing carried out by the law firm to the resolution of any incidents that may arise.

Identification of personal data processing

• The personal data processed: what personal data are collected, recorded, stored, modified, consulted, used, published, combined, erased or destroyed?
• The purposes of processing: for what purposes are personal data processed?
• Categories of data subjects: which categories of data subjects are affected by the processing of personal data?
• The legal basis for processing: on what legal basis is the processing of personal data based?

Once the processing of personal data has been identified, the law firm must document it. This documentation should include the information necessary to demonstrate that the law firm complies with data protection regulations:

• A description of the processing of personal data: what personal data are processed? For what purposes? What categories of data subjects are concerned? What legal bases are used?
• The legal basis for the processing of personal data: on what legal basis is the processing of personal data based?
• Technical and organisational security measures applied to the processing of personal data: what measures have been taken to protect personal data?

Preparation of data protection documentation

Data protection documentation must be up to date and easily accessible to authorised persons.

The main documents that should be part of the data protection documentation are the following:

• Privacy policy.
• Register of processing activities.
• Information to interested parties.
• Incident management procedures.