Sumsub How to: Guide for Navigating in GDPR

Implementing General Data Protection Regulation (GDPR), a new data privacy law from the European Union (EU), is not a one-time activity but an important process for every business that works with personal data in the EU.

For companies, GDPR means obligations for collecting, handling, or analyzing personal data with greater control over the personal data of the individuals.

Implementing organizational changes to comply with the GDPR is not an easy task. That is why our legal department made a highly detailed How-to guide for you. The guide offers a clear approach for creating and executing the GDPR compliance program — the necessary steps what to do and what to check.

Please note that our GDPR Guide has no legal force.

What is GDPR?

New, privacy and data protection law of the EU calls for more detailed privacy rules in the organizational systems, explicit data protection agreements, and consumer-oriented disclosures about privacy and data protection practices in the organisation.

GDPR applies to all companies and organisations, including freelancers, even those who store personal information in an address book. All material or digital devices and software should be checked and audited to be sure that all personal data on it is protected according to the new regulation.

What if you are located outside the EU?

GDPR is applied not just towards the organisations located in the EU, but to any globally operating company that processes data of the EU individuals, offers goods and services to them or monitors their behavior.

What is “Personal Data” and what does “processing” mean?

Under GDPR Personal data is any information related to an identified or identifiable individual. But it is not just the name or email address of a person. Financial information, an IP address, biometric data also fall within the GDPR protection.

Moreover, some categories of personal data are under a higher level of protection due to their sensitive origin. That includes information about political opinion, religious and philosophical beliefs, race and ethnic origin, trade union membership, genetic data, biometric and health data, information about a person’s sex life and orientation, criminal record information.

Processing of personal data means any operation that is conducted on personal data or on sets of personal data. Regardless if it is performed automatically, any process that stores or consults personal data is determined as processing. Most common activities are collection, recording, systemisation, structuring, storage, adaptation or alteration, retrieval, consultation, usage, disclosure by transmission, dissemination or opening information by any means, alignment or combination, restriction, erasure or destruction.

Determining participants: data controllers and data processors

The data controller and the data processor — are two entitled bodies that can process personal data.

The data controller determines the purposes and means of the processing of personal data — alone or jointly with others. The data processor processes the information on behalf of the controller.

A decision on whether a controller or a processor will proceed the personal data should be made when designing an interaction model with the GDPR. It will help to understand what rights and obligations are entitled to each operator.

However, these roles could be dual. Sumsub is a good example. Sumsub processes personal data, such as the ICO contributor’s name, ID number, expiry date, and others, as soon as the data is sent by a user to Sumsub via Sumsub API. After that Sumsub uses the data to conduct the KYC process using the database systems and software. That is a function that Sumsub performs as a data processor.