Who Are We?
TrackTik is the provider of security operations management software and is the industry’s only all-in-one platform offering security service companies complete control of every aspect of their business. TrackTik saves customers time and money by enabling them to access insight, streamline operations, and improve business development through easy-to-use mobile and web-based technology, customized implementation and technical support, and a personalized sales toolbox. TrackTik has become the No. 1 software for security experts by driving efficiency and growth through automation and accurate data. For details, visit www.TrackTik.com.
What Is The GDPR?
The General Data Protection Regulation (GDPR) is a new European data protection law that will take full effect on May 25, 2018. It supersedes the Data Protection Directive (95/46/EC) and its national implementations in all European member states, with the primary objective of giving individuals back control of their personal information and simplifying the regulatory environment for international companies.
The GDPR applies to ‘personal data,’ meaning any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier. This definition provides a wide range of personal identifiers to constitute personal data, including name, identification number, location data, IP address, or online identifier, reflecting changes in technology and how organizations collect information about people.
The GDPR affects both ‘controllers’ and ‘processors.’ A controller is an entity that determines the purposes and means of processing personal data. In contrast, the processor is an entity responsible for processing personal data on behalf of a controller. For the first time, processors now have direct obligations – not only controllers – including keeping a record of processing activities or notifying the controller following data breaches. In the meantime, controllers are required to engage data processors that provide “sufficient guarantees.” TrackTik, as a processor, understands and takes these new data protection requirements seriously. This brochure will provide general information about the GDPR and describe our position and concrete initiatives.
What Are The Ten Key Changes Under The GDPR?
| 1 | Territorial Scope | The GDPR applies to companies established in the EU and those outside the EU who offer goods or services to EU residents or monitor their behavior within the EU. |
| 2 | Consent | The GDPR introduces a high bar for relying on consent in that it must be freely given, specific, informed, unambiguous, and separate from other terms in clear and plain language. Further, data subjects shall be able to withdraw their consent at any time in a simple manner. |
| 3 | Data Subjects’ Rights | The GDPR provides individuals with new and enhanced rights, including a right to data portability, a right to restriction of processing, a right to be forgotten, or a right not to be subject to a decision based solely on profiling in certain circumstances. |
| 4 | Accountability | The GDPR places significant accountability obligations on companies to demonstrate compliance, such as maintaining certain documentation, conducting data protection impact assessment for higher risk activities, or implementing data protection “by design” and “by default” (e.g., data minimization). |
| 5 | Transparency | The GDPR requires companies to provide substantial disclosure companies to data subjects when collecting their personal data to ensure that their processing activities are fair and transparent. |
| 6 | Data Protection Officer | The GDPR requires designating a Data Protection Officer (DPO) where the processing involves regular and systematic monitoring of EU residents or concerns certain data categories on a large scale. The DPO will need to have sufficient expert knowledge. |
| 7 | Breach Notification | The GDPR requires controllers to notify a data breach to the relevant supervisory authorities unless it is unlikely to represent a risk to the rights and freedoms of the data subjects in question. This must be done without undue delay and, where feasible, within 72 hours of awareness. In some cases, the data controller must also notify the affected data subjects without undue delay. |
| 8 | International Data Transfers | The GDPR continues to prohibit data transfers to countries outside the EEA unless an adequate level of protection exists in the destination country. Moreover, the GDPR restates existing transfer mechanisms, such as Standard Contractual Clauses or Binding Corporate Rules, and provides additional mechanisms, including approved codes of conduct and certification schemes. |
| 9 | One-Stop-Shop | The GDPR enshrines a one-stop-shop mechanism establishing that companies will mainly be regulated by the supervisory authority where they have their “main establishment.” |
| 10 | Sanctions | The GDPR provides supervisory authorities with wide-ranging powers to enforce compliance, including imposing significant fines (up to € 20 million or 4 % of annual worldwide turnover in some cases). |
How Do We Situate Ourselves With The GDPR?
TrackTik acts as a ‘processor’ for the personal data you and your employees submit electronically into our software-as-a-service applications. As such, TrackTik processes personal data on your behalf and according to your instructions. You determine what personal data is submitted and processed within TrackTik ’s cloud service and always remain the controller. Our processing activities involve securely storing your personal data and processing personal data as necessary to operate, support, and maintain our software-as-a-service applications.
TrackTik takes all data protection laws applicable to us seriously in our role as data processors, including the applicable requirements of the GDPR when it took effect on May 25, 2018. That being said, it is also your responsibility to use our software-as-a-service applications in a manner consistent with your own legal and regulatory obligations.
How Can We Help You to Comply With The GDPR?
TrackTik is aware of your concerns: as data controllers, you are required by GDPR to engage data processors that provide “sufficient guarantees,” in particular in terms of expert knowledge, reliability, and resources, to implement appropriate technical and organizational measures that will meet GDPR’s requirements for the protection of the personal information of data subjects.
TrackTik must, therefore, be able to provide our clients with those guarantees. More than that, TrackTik is committed to facilitating your journey to GDPR compliance programs and supporting you in our position as the processor. Here is a sample of our concrete actions in this regard:
Data Subjects Requests. TrackTik offers configurable features to help customers respond to their employees’ requests to access, correct, delete, or restrict their data and comply with data portability requests under the GDPR.
Security Measures. TrackTik has implemented various technical and organizational measures to protect our customers’ personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access to personal data. TrackTik’s technical and organizational measures regularly pass rigorous third-party compliance audits for security, confidentiality, availability, processing integrity, and privacy controls.
Data Breach Notification. Under the GDPR, our customers, as controllers, must notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of a personal data breach unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. If TrackTik becomes aware of a personal data breach affecting our customers’ personal data, TrackTik will notify our customers without undue delay and assist our customers in meeting their data breach notification obligations by providing the relevant information regarding the personal data breach.
Do you Want To Know More About The GDPR?
GDPR official text: http://data.europa.eu/eli/reg/2016/679/oj
GDPR portal: https://gdpr.eu/
European Commission, Data Protection: https://ec.europa.eu/info/law/law-topic/data-protection_en
ICO, Guide to the GDPR: For organisations | ICO
CNIL, Be ready for the GDPR: https://www.cnil.fr/se-preparer-au-reglement-europeen
Contact Us
Please contact us if you have any questions or inquiries about this brochure: privacy@TrackTik.com
Disclaimer
This page is intended to convey general information only and should only be used as a starting point to understand issues relating to GDPR. This is not intended as legal advice or to convey legal facts or opinions. The contents of this document should not be relied upon in any particular situation, and the information presented here is not guaranteed to be correct, complete, or up-to-date. No action should be taken based on the information found here, and TrackTik disclaims all liability concerning any acts or omissions based on the contents of this document. Consult a licensed attorney or regulatory expert to discuss your legal, compliance, and GDPR-related issues.