We help businesses process personal data carefully and respond to data breaches, complaints and regulatory scrutiny. We focus on actual data flows, appropriate legal bases, supplier arrangements and workable internal procedures.
We help businesses process personal data carefully and respond to data breaches, complaints and regulatory scrutiny. We focus on actual data flows, appropriate legal bases, supplier arrangements and workable internal procedures.
Personal data play a role in almost every business: in personnel records, customer databases, websites and digital services. Privacy law calls for decisions that are legally sound and work in practice. Guldemond Advocaten helps organisations assess their data processing, document arrangements with suppliers and respond to data breaches, complaints or regulatory investigations.
The General Data Protection Regulation (GDPR) is the main European framework for processing personal data. The Dutch GDPR Implementation Act, Telecommunications Act and sector-specific rules may also apply. The initial questions are always: what data do you process, for what purpose, on what legal basis, and who is responsible?
The 2017 proposal for an ePrivacy Regulation has been withdrawn, as shown by the legislative file on EUR-Lex. It therefore cannot be treated as current law or certain forthcoming legislation. For cookies and similar technologies, the applicable rules on access to equipment and processing personal data remain relevant.
A privacy notice alone does not make an organisation GDPR-compliant. We also examine the practical arrangements: access to data, retention periods, information for data subjects, security and internal responsibilities. Where needed, we assist with a record of processing activities, a data protection impact assessment (DPIA), policies and practical staff instructions.
For new products or working methods, it is sensible to consider privacy from the design stage. This can avoid having to modify a project just before launch. We tailor our advice to your services, the nature of the data and the risks to data subjects.
For cloud software, marketing services and outsourcing, it must be clear which party is the controller or processor. Actual roles are decisive; an agreement’s heading alone is insufficient. We advise on processing arrangements, security, subprocessors, incident notifications, checks and the return or deletion of data.
For transfers outside the European Economic Area, we assess the available transfer mechanism and any additional assessment or measures required. We connect this with your contractual arrangements and the continuity of your SaaS services.
Following a data breach, establishing the facts quickly, limiting the consequences and documenting decisions are essential. Not every incident requires notification, but the assessment cannot be left unattended. Where notification to the supervisory authority is mandatory, the deadline is generally 72 hours after the organisation becomes aware of the breach. Informing data subjects requires a separate assessment.
We assist with the legal assessment, notifications and communications. We also help with requests for access, rectification or erasure. These rights are not unlimited: statutory retention duties and the rights of others may, for example, be relevant. Information on supervision and notifications is available from the Dutch Data Protection Authority.
Camera surveillance, employee monitoring and sickness information bring privacy and employment law together. We assess necessity, proportionality, information duties and any employee participation rights. For websites and marketing, we examine cookies, consent requests and how understandable the information is.
The GDPR and other applicable rules remain relevant to AI applications too. We help make the processing behind the technology clear.
We advise on prevention and represent organisations in disputes, complaints and investigations by the Dutch Data Protection Authority. We assess the facts, legal obligations and possible next steps. Explore our broader technology, privacy and data practice or discuss your question with us.
No. The GDPR provides several legal bases, each with its own conditions. Processing may sometimes be necessary for a contract or a legal obligation. Legitimate interests require, among other things, necessity and a balancing of interests. Consent must be freely given, specific, informed and unambiguous, and can be withdrawn; it is not a universal remedy for every use of data.
Not automatically. What matters is whether the supplier processes personal data on your organisation’s behalf or acts as controller for certain processing. A party may have different roles for different activities. Actual powers and purposes take precedence over the contractual label.
The right of access concerns the person’s own personal data and does not provide unrestricted access to complete business records or other people’s data. At the same time, an organisation may not reject a request on confidentiality grounds without assessing it substantively. Scope, exceptions and protection of other data subjects must be examined.
