Progetto Sud

Progetto Sud is a Third Sector organisation that processes the personal data of beneficiaries, members, employees and volunteers. The sensitivity of the context called for particularly careful GDPR compliance.

The need

There was no structured documentation system. Processing was handled informally, without the Article 30 records and with outdated privacy notices. Appointing an external DPO had become necessary because of the large scale of vulnerable people involved.

The Forgest approach

We proposed a programme structured in four phases:

1. Initial audit

Mapping of the processing operations through interviews with the internal managers, analysis of the information systems, of the data flows with external suppliers and of the legal basis for each processing operation.

2. Documentation

• Records of processing under Article 30 GDPR, complete and kept up to date.
• Privacy notices tailored to each category of data subject (beneficiaries, members, employees, volunteers, applicants, newsletter, website).
• Appointments of the external processors for all suppliers who process data on behalf of the controller.
• Written procedures for data breaches and data subject rights.

3. External DPO

Forgest appointed an external Data Protection Officer with the experience and independence required by the GDPR. The DPO is:

• the point of contact for data subjects and for the Garante, the Italian data protection authority;
• an ongoing adviser to the controller;
• the trainer of the authorised staff.

4. Training

A training programme for staff authorised to process data, focusing on:

• the principles of lawfulness, purpose limitation and minimisation;
• handling data subject requests;
• operating procedures in the event of a data breach.

Result

A complete documentation system that can be demonstrated in the event of an inspection by the Garante. A privacy culture spread throughout the organisation. Ongoing availability of the DPO for ad hoc advice.