SUBSIDISED Educational GDPR Seminars from HRD

Training and Educational seminars

C.O. Eurocompliance Services training seminars will provide you with the GDPR /PIPEDA KNOWLWDGE

• To be compliant with the new GDPR Regulation & Canadian PIPEDA Law`s
• To know and to safeguard the legal rights of our Data Subjects

C.O. Eurocompliance Services training and seminars will increase your GDPR/PIPEDA SKILLS

• To carry out proper inspections in all stages of the processing of the Personal Data to avoid breaches.

• To be able to inspect and supervise the safe transfer of Personal Data from one place to another.

C.O. Eurocompliance Services training and seminars will cultivate GDPR/PIPEDA behavior

• To motivate your colleagues to curry out proper inspections on Personal Data during processing of same
• To put in place proper technical and organizational methods in order to be in full compliance with GDPR Regulation & PIPEDA Law`s

HRDA Subsidy procedure with Regards to Cyprus-EU Data Protection Training

The Human Resource Development Authority (HRDA) of Cyprus, is offering subsidized training educational programs to companies wishing to train their employees via courses/ programmes approved by HRDA

  Training company employees in the practical implementation of General Data Protection Regulation (GDPR) are among the subsidized training programs approved by the HRDA  

Business entities registered in Cyprus, may be eligible to attend HRDA subsidized training programmes and participate with a reduced fee (pay the subsidized price), who meet the following:

 HRDA requirements are as follows:

• – The business entity must be registered in the Republic of Cyprus, under the Department of Registrar of Companies and to be active.
• The business entity must be registered in the Social Insurance Services and all social insurance payments are up to date.
• – The Employees participating in the respective training courses must be employed on a full-time employment basis.
• – The business entity needs to submit to HRDA their employees’ proof of their relevant social insurance contributions prior for approval.
• – Prospective attendees meet the participant profile for the respective training course.
• – C.O. Eurocompliance Services will undertake to register the Participating companies and their employees through the HRDA  ERMIS website.
• C.O. Eurocompliance Services will finalize the procedure on your behalf before the start of the course.
• C.O. Eurocompliance Services will keep you informed and assist you at all times after your registration to an HRDA course from the ERMIS website
• – Participants attend at least 75% of the course’s total duration
• – The training fee is paid directly from the participating company’saccount to C.O. Eurocompliance Services who will issue the relevant invoice and receiptof payment.
• After the course’s completion the participating company will submit the C.O. Eurocompliance Services invoice and proof of payment to HRDA for the relevant compensation.

GDPR Attendance Certificates

Educational Training & Attendance Certificates

On completion of the GDPR/PIPEDA training course C.O. Eurocompliance Services will issue attendance certificates to all participants to proof that they attended the EU-GDPR/PIPEDA training course as required by the EU-GDPR regulation & PIPEDA Canadian Law`s.

Copies of these training certificates must be kept in the participating company`s record to indicate that their employees have received the required training.

Under Article 47, in connection with Binding Corporate Rules (BCRs), the GDPR requires “the appropriate data protection training to personnel having permanent or regular access to personal data.” Training is also required by the Canadian PIPEDA Law`s and US-EU Privacy Shield Framework.

​EU- GDPR/Canadian PIPEDA training is important for employees because it helps them understand their responsibilities in handling personal data and ensures compliance with data protection regulations.

Failure to train your staff who collect, and process personal data can lead to administrative penalties and fines by the relevant EU supervisory authority or from the Canadian Office Of The Privacy Commissioner (OPC) on a basis of negligence.

GDPR General Consultancy at your premises

TRAINING AT YOUR PREMISESS

Please be reminded that ignoring the GDPR or getting it wrong can be detrimental and very expensive consequence for a particular company, resulting in Heavy Fines, Bad Reputation, Financial Loss, Legal and other similar consequences.

C.O. Eurocompliance Services will carry out the Theory and practical implementation of GDPR at your place of work, at your convenience.

These GDPR seminars and GDPR full practical implementations carried out at your premises are carefully designed by C.O. Eurocompliance Services to suit your company`s operational needs and are fully subsidized by EU and the Cyprus Government through (HRD).

The training and certification of your staff is essential, is required by the Law, as well as by all Professional Organizations for the accumulation of credits for Continued Professional Development (CPD).

Preparation of GDPR Privacy Agreements & GDPR Manuals

The controller/Processor) —- in accordance with the EU GDPR 2016/679 in force since May 24, 2016 and enforced in May 25, 2018, are bound by EU law to enforce the privacy and security rights of data subjects consistently across the EU and globally through our GDPR representative:

The GDPR (General Data Protection Regulation) requires that the collection of personal data by controller/processor according to Article 13.1 shall provide the data subject with the following information (privacy notice).

C.O. Eurocompliance Services will assist you in preparing your company`s privacy agreement in line with the GDPR requirement which will include the following:

• The identity and contact details of the controller and processor.
• The fact that the controller intends to transfer the personal data to a third country and the existence of adequacy conditions.
• The purpose of processing as well as the legal basis of processing.
• The legitimate interests pursued by the controller or third party.
• The recipients of these personal data.
• The period the data will be stored.
• The right to rectification, erasure, restriction, objection.
• The right to withdraw consent at any time.
• The right to lodge a complaint with the supervisory authority.
• The consequences of breached confidentiality or if the data will be compromised.
• The existence of automated decision making, including profiling, as well as anticipated consequences for the data subject.
• The controller and processor shall implement appropriate technical and organizational measures to ensure security appropriate to the risks involved in safeguarding the integrity, confidentiality, availability and the severity of the rights and freedoms of the data subject from the danger of accidental, or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, stored or otherwise processed.
• The data subject has the right of judicial remedy against the controller and processor and the right to compensation and liability if his personal data are compromise.

Preparation of Data Inventory Lists

PREPARATION OF DATA INVENTORY LIST

C.O. Eurocompliance Services will assist you in preparing and maintaining your organization`s Data Inventory List

• Creating robust privacy protection programs is only possible when organizations understand their data well.
• Data inventories enable a business or organization to have a comprehensive understanding of the data they hold and how each piece of the data is being used and stored.
• For this reason, data inventories are critical to building a solid data protection program, which can lead to improved GDPR  

What Is a Data Inventory?

Data inventory lists can help an organization to assess whether the organization is collecting and storing the right data, the need to collect a particular type of data and whether the data are valuable and sufficient.

A data inventory is a comprehensive list of data assets collected, processed, and stored within the organization.

A data inventory includes updated information about data, its source, and additional metadata.

Data inventories within an organization are directories used to manage data, especially sensitive data, and maintain compliance.

Moreover, sensitive data within the organization is not limited to Personal Data only.

Sensitive data can also include business data about vendors processes, information about the contract between attorney and their client and intellectual property data.

All of the above data is classified as sensitive data and they have to be captured within your data inventory lists to be comprehensive.

Data inventory lists can help businesses to identify which data they need and can be safely stored.

GDPR Data Mapping

DATA MAPPING

The data flow map will show the flow of personal data from one location to another, within your organization, between your controllers, processors, sub-processors and international representatives in the EU.

Data processing can change within a process, and it is only by data flow mapping each stage of the process that you can be sure that you identify all the privacy risks.

The flow map will identify the key elements of the data inventory such as items, formats, transfer methods and locations.

C.O. Eurocompliance services will assist you in conducting Data Mapping exercises.

Data Mapping is the map that shows the transfer of information of Personal Data from one location to another.

Data Processing can change within a process, and it is only by Data Mapping each stage of process that you can be sure that you can identify all the privacy risks.

Data Mapping can assist you to walk through the privacy information lifecycle to identify unforeseen or unintended uses of the data.

Ensure that the people who will use the Personal Data information are consulted on the practical implications

Consider the potential future uses of the Personal Data information collected, even if it is not immediately necessary.

C.O. Eurocompliance Services will assist you with how to plot Data Mapping based on your information flow, thus identifying the key elements (data inventory) listed below:

• Data items: Names, email addresses, health data, criminal records, Biometric location.

• Formats: Hard copies, paper records, Digital USBs, Data bases.

• Transfer methods: Post, telephone, social media, internal within the group, external data sharing.

Locations: Offices, Cloud, 3rt parties.

C.O. Eurocompliance Services will assist you to be aware of the many information risks that exist and to take appropriate measures to safeguard your own information.

That you have appropriate security controls in place to protect the personal data of your data subjects.

That you are continuously assessing the risks that can compromise the rights and freedoms of data subjects.

Data Protection Impact Assessments (DPIA)

DATA PROTECTION IMPACT ASSESSMENT

C.O. Eurocompliance Services will assist you in preparing your Protection Impact Assessment in line with the following GDPR requirements

In such cases, a data protection impact assessment should not be mandatory.

In order to enhance compliance with this Regulation where processing operations are likely to result in a high risk to the rights and freedoms of natural persons, the controller should be responsible for the carrying out of a data protection impact assessment to evaluate the origin, nature, particularity and severity of that risk. 

The outcome of the assessment should be considered when determining the appropriate measures to be taken in order to demonstrate that the processing of personal data complies with this Regulation. 

Where a data-protection impact assessment indicates that processing operations involve a high risk which the controller cannot mitigate by appropriate measures in terms of available technology and costs of implementation, a consultation of the supervisory authority should take place prior to the processing.

This should apply to large-scale processing operations which aim to process a considerable amount of personal data at regional, national or supranational level.

 Which could affect many data subjects, and which are likely to result in a high risk.

For example, on account of their sensitivity, where in accordance with the achieved state of technological knowledge a new technology is used on a large scale as well as to other processing operations which result in a high risk to the rights and freedoms of data subjects.

 Where those operations render it more difficult for data subjects to exercise their rights. 

A data protection impact assessment should also be made where personal data are processed for taking decisions regarding specific natural persons following any systematic and extensive evaluation of personal aspects relating to natural persons based on profiling those data or following the processing of special categories of personal data, biometric data, or data on criminal convictions and offences or related security measures. 

A data protection impact assessment is equally required for monitoring publicly accessible areas on a large scale, especially when using optic-electronic devices or for any other operations where the competent supervisory authority considers that the processing is likely to result in a high risk to the rights and freedoms of data subjects.

 Because they prevent data subjects from exercising a right or using a service or a contract, or because they are carried out systematically on a large scale. 

The processing of personal data should not be on a large scale if the processing concerns personal data from patients or clients by an individual physician, other health care professional or lawyer. 

Preparation of GDPR Legal Binding Contracts

C.O. Eurocompliance Services will assist you to prepare your organizations required GDPR Legal binding contracts in line with the following GDPR requirements

• The General Data Protection Regulation (GDPR) has fundamentally reshaped the way organizations handle personal data. Among its various legal obligations, ensuring GDPR compliance in contracts is critical for businesses that process personal data, particularly when engaging third-party service providers.
•  Failure to implement EU-GDPR-compliant contractual agreements can expose businesses to significant legal and financial risks.

C.O. Eurocompliance Services will assist you in adopting the legal requirements for GDPR compliance in contracts and best practices to mitigate your potential liabilities.

C.O.Eurocompliance Services will provide you with Legal Contractual EU-GDPR Templates to assist you in preparing your own organization tailor made Legal Binding Contracts in strict accordance with your organization`s processing activities

• Under EU-GDPR, contracts that involve data processing must meet stringent legal requirements to protect personal data.
•  The regulation mandates that controllers (those determining the purpose and means of processing) and processors (those processing data on behalf of controllers) formalize their relationships through legally binding agreements.
• These agreements must ensure that both parties adhere to GDPR’s principles and obligations.

Key Legal Requirements for GDPR Compliance in Contracts 

To align with GDPR, contracts must include specific provisions that regulate data processing activities.

The following are critical elements that should be incorporated into contracts:

1. Data Processing Agreements (DPAs) under Article 28 GDPR

One of the key provisions of GDPR is Article 28, which requires controllers and processors to have a written agreement, commonly referred to as a Data Processing Agreement (DPA). A GDPR-compliant DPA must include:

• Scope and Purpose: A clear definition of the nature, scope, and purpose of data processing.
• Types of Personal Data: Specification of the categories of personal data processed.
• Obligations of the Processor: The processor must only process data based on the controller’s instructions and implement appropriate security measures.
• Confidentiality and Security: Provisions ensuring that personnel handling personal data maintain strict confidentiality and adhere to security requirements.
• Sub-Processor Restrictions: A requirement for processors to obtain written consent before engaging sub-processors and ensuring compliance through binding agreements.
• Data Subject Rights: Processes enabling the controller to respond to data subject requests, including access, rectification, and erasure.
• Data Breach Notification: Obligations to notify controllers of any data breaches without undue delay.
• Data Deletion or Return: Requirements for the processor to delete or return personal data once processing is completed.
• Legal Basis for Data Processing in Contracts

Under Article 6(1)(b) of GDPR, contracts can serve as a legal basis for data processing when processing is necessary for contract performance. This provision is especially relevant in agreements involving employees, customers, or service providers.

However, organizations must ensure that contractual clauses do not override GDPR’s transparency and fairness requirements.

• Standard Contractual Clauses (SCCs) for Cross-Border Transfers

For businesses that transfer personal data outside the European Economic Area (EEA), GDPR mandates the use of Standard Contractual Clauses (SCCs) or other approved mechanisms. SCCs provide a legal framework ensuring that transferred data receives the same level of protection as within the EU.

Organizations must regularly review SCCs to reflect regulatory updates and judicial decisions.

• Liability and Indemnification Provisions

Contracts should clearly define liability clauses to allocate risks between controllers and processors. Businesses must ensure that contracts include:

• Liability Limits: Specified financial and legal responsibilities for data breaches.
• Indemnification Clauses: Obligations for parties to compensate damages arising from non-compliance.
• Auditing Rights: Controllers’ right to audit processors’ compliance with GDPR requirements.                 

Best Practices for Drafting GDPR-Compliant Contracts

Beyond legal requirements, businesses should adopt best practices to strengthen their contractual compliance with GDPR:

1. Conduct a Data Processing Assessment

Before entering contracts, businesses should assess whether the agreement involves personal data processing and identify GDPR obligations accordingly.

• Use GDPR-Compliant Contract Templates

Utilizing standardized contract templates that incorporate GDPR provisions can streamline compliance efforts while ensuring legal adequacy.

• Regularly Review and Update Contracts

GDPR compliance is an ongoing process. Contracts should be periodically reviewed to reflect regulatory changes, case law developments, and evolving business practices.

• Train Employees and Stakeholders

Organizations should provide training to employees, legal teams, and partners on GDPR compliance in contractual relationships to prevent inadvertent violations.

• Implement Robust Security Measures

Contracts should specify technical and organizational security measures to prevent unauthorized access, data breaches, and other risks.

DATA PROTECTION OFFICER IN EU & INTERNATIONALLY

C.O. Eurocompliance Services can act as your Data Protection Officer (DPO) in EU and Data Protection Representative (DPR) for Non EU Countries

The role of Data Protection Oficer (DPO)

• Where core activities require regular and systematic monitoring of personal data on a large scale.

• DPO is appointed where:
• Where the processing is carried out by a public body (except courts)

• Where core activities involve large-scale processing of special categories of data.

• Processing Data of Criminal Convictions & Offences

• Hospitals, City Public Transport & Municipalities

• Controller and processor must ensure active involvement of the DPO.

• Controller and processor must provide necessary resources.

• DPO has a large degree of independence:
  • Direct access to highest management.
  • Data subject has clear access to DPO.
  • Bound by confidentiality.
  • No conflict of interest arising from additional tasks or duties.

The Role of Data Protection Representative (DPR)

C.O. Eurocompliance Services can act as your European Union Representative for Non Eu countries to comply with the following GDPR Regulation requirements.

• Non-EU Business that provides systematically products, services, process or store Personal Data of EU citizens and monitor their behavior require to appoint an EU Representative.
• Free services to EU citizens by a non-EU business is within scope of DGPR Regulation.
• This applies if the non-EU organization does not have an office in one of the EU member states.
• The EU Representative can be a Physical Person that has a permanent residence in EU or a Legal Person such as a company with registration in one of the member states.
• The Representative will act as the main contact for any questions or concerns regarding Data Protection from any EU citizen or any EU Supervisory Authority.
• The appointment of a Representative is made without prejudice to legal obligations which could be initiated to Non-EU Controller or Processor.
• For the appointment of a Representative a legal binding corporate contract must be in place.
• The Representatives may be subject to enforcement actions of the Supervisory Authorities in the event of non-compliance by the Non-EU Controller or Processor.
• Failing to appoint a Representative a company or any organization could be fines up to €10m or 2% of their global turnover.
• GDPR requirements to assist you to obtain full compliance.

GDPR Annual Audits & Reporting

ANNUAL GDPR AUDITS

C.O. Eurocompliance Services will train your staff the Best Practices for a Successful GDPR Compliance Audit:

• To Comprehend the Requirements: to Familiarize your staff with GDPR’s expectations, including protecting personal data and upholding individual rights.
• To Conduct a Self-Assessment: To Examine your data practices. Are you collecting, storing, and using data responsibly? Identify issues early.
• To Ensure Lawful Processing: To Have a valid reason for processing personal data, such as consent, contractual obligations, or legal requirements.
• To Uphold Individual Rights: To Be prepared to respond promptly to requests for data access, correction, or deletion.
• To Secure Your Data: How to Protect personal data with strong safeguards like encryption and robust access controls.
• To Have a clear breach management plan.
• To Address High-Risk Activities: If data processing poses risks to individuals, your staff need to conduct a Data Protection Impact Assessment (DPIA) to identify and mitigate those risks.
• On completion of the final annual audit, a comprehensive audit report will be issued showing the areas where the security of personal data has been breached and how to achieve a more rigid GDPR Compliance.

Direct marketing rules and exceptions under the EU- GDPR

C.O. Eurocompliance Services will assist you in understanding your responsibilities and legal obligations for your Direct Electronic marketing, including your text messages (SMS) and your emails that your customer receives from you on a product or for your services . But your activities of direct marketing may include multiple steps:

•  collecting personal data from potential customers,
• creating profiles about those potential customers and their preferences,
• and then sending personalized communications to them.
• C.O. Eurocompliance Services will explain to your organization staff in detail, the general rule for direct marketing, that your company needs a consent from a customer. However, there are several exceptions when it’s allowed to send the emails to the customers without asking for a consent.

• The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest. But it’s not so easy.

• Direct electronic marketing is currently regulated under the Privacy Directive, which generally requires opt-in consent before engaging in such activity. This means that in most cases, even if you are relying on legitimate interests, the privacy Directive would still require consent.

• However, there is an exception—marketing emails may be sent on an opt-out basis if the recipient’s details were collected “in the context of the sale of a product or a service,”(Directive 2002/58/EC, Article 13(2).). Please bear in mind that this exception has been implemented differently by the EU member states and some differences may apply, especially in case of B2B communication.

• In case of B2B communication, company representative can be contacted for direct marketing purposes for business related products or services through electronic mail without their prior consent but only in the context of the position they hold.
• Therefore, there are additional exceptions for B2B direct marketing rules.

• Article 21 of the GDPR states that “where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing” and that “where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.” even if opt-in consent is not required before sending marketing emails, the GDPR requires that the recipient always be provided with an opportunity to opt-out of receiving such emails.

• Eurocompliance Services will provide you with multiple Examples of Opt-In

 whenever users visit your website, they can manually opt in to retain their online activity for various purposes. When a user first arrives on your page, all boxes are unchecked. The user can choose to opt-in to any box of their choice or select them all, indicating the website of their preferences.

• An opt-in consent can be successfully implemented as follows:      

• Process users’ personal data only once their consent has been obtained,
• Ask users to either accept or reject the use of cookies by providing equal prominences to “accept” and “reject” options on the consent banner,
• Provide sufficient information to users about why their personal data will be collected and what it will be used for,

C.O. Eurocompliance Services

 will assist you on the opt-out process and the meaning of what is Opt-Out?

• An opt-out process requires the user to take action to unsubscribe if they no longer want to receive emails or newsletters. Opt-out is when they add you to their mailing list and give you the option not to receive their emails.

• There are two main ways through which opt-out options are offered to the consumer:
• Pre-emptive opt-out – a consumer can untick/uncheck a pre-selected checkbox or otherwise undo a confirmation indicating their refusal to data processing.
• Consent withdrawal – where users are provided a clear option to withdraw their permission or change their preferences concerning the treatment of their personal data.

C.O. Eurocompliance Services will provide you with multiple examples of Opt-Out customer choices.

• An opt-out consent can be successfully implemented as follows:

• Indicate the “Do Not Sell My Personal Information” button or link on the website’s homepage as well as in the privacy policy enabling users to opt-out of the sale and sharing of their personal data.
• This is relevant for compliance with the California Consumer Privacy Act (CCPA),

Provide sufficient information to users about the categories of personal data to be collected and their purposes, including the sensitive personal data and their purposes,

Inform users whether their personal data is sold or shared, the length of time the organization intends to store and make use of it.