GDPR Business Continuity Compliance Software

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that was introduced by the European Union (EU) and came into effect on May 25, 2018. It is designed to protect the privacy and personal data of individuals residing in the EU.

In the context of the UK, the GDPR continues to apply despite the UK's departure from the EU. However, after Brexit, the UK has its own version of the GDPR called the UK GDPR, which is essentially the same as the EU GDPR with some minor modifications to make it suitable for the UK legal framework. The UK GDPR ensures that data protection standards remain consistent in the UK and align with the EU's standards to facilitate data transfers between the UK and EU member states.

Under the UK GDPR, individuals have certain rights regarding their personal data, such as the right to access their data, the right to rectify any inaccuracies, the right to have their data erased, and the right to object to or restrict the processing of their data. It also places obligations on organisations that process personal data, requiring them to handle it securely and responsibly.

The UK GDPR is enforced by the Information Commissioner's Office (ICO), which is the UK's independent authority for promoting and enforcing data protection laws. The ICO has the power to investigate data breaches, issue fines, and take other regulatory actions to ensure compliance with the UK GDPR.

Yes, Crises Control's offer comprehensive reporting and analytics features that allow organisations to track compliance with GDPR and compliance related to ISO 27001, ISO 22301 and ISO 90001.

The audit data can also be exported to CSV and XLS format for further analysis.

Crises Control operates in various regions, including the UK, EEC (European Economic Area), Saudi Arabia, UAE, and Oman. To comply with local data protection laws, the Crises Control solution is designed to adhere to the specific regulations of each region. One key aspect of compliance is ensuring that data remains within the respective region and does not leave its boundaries.

In the UK, Crises Control ensures compliance with the UK GDPR, which is the local adaptation of the European Union's GDPR after Brexit. This means that personal data is handled according to the UK's data protection standards, and any data processed by the software remains within the UK region.

For the EEC region, which consists of EU member states and EEA countries, Crises Control complies with the EU GDPR. The solution ensures that personal data processed in this region remains within the EEC boundaries, in accordance with the GDPR's data transfer requirements.

In Saudi Arabia, UAE, and Oman, Crises Control aligns with the specific data protection laws and regulations of each country. The solution is designed to handle and process personal data within the boundaries of these regions, ensuring compliance with the respective local data protection frameworks.

To comply with USA data protection laws (after July 16, 2020, at which point the EU-U.S. Privacy Shield was invalidated by the Court of Justice of the European Union) we can offer alternative methods to ensure lawful data transfers from the UK to the U.S.

Here are some options to meet U.S. data protection laws:

1. Standard Contractual Clauses (SCCs): Organisations can use SCCs, which are pre-approved contractual clauses issued by the European Commission, to govern data transfers from the UK to the U.S. SCCs establish data protection obligations and safeguards to ensure an adequate level of protection for the transferred data.
2. Binding Corporate Rules (BCRs): BCRs are internal rules for multinational organisations that govern data transfers within the group of companies. Crises Control can establish BCRs to ensure compliant data transfers to U.S. entities within the same corporate group.
3. Consent: If individuals provide explicit and informed consent for their personal data to be transferred to the UK for processing. The consent to be freely given, specific, informed, and unambiguous.
4. Derogations: In certain limited circumstances, organisations may rely on derogations as outlined in the UK GDPR to transfer data to the U.S. These derogations include situations where the transfer is necessary for the performance of a contract, protection of vital interests, legal claims, or public interest.

Yes, Crises Control's privacy policy can be viewed at the foot of each website page.