How Nets has applied the GDPR regulation

​The General Data Protection Regulation (“GDPR”) is a new EU regulation that regulates the collection, use, sharing, retention etc. ("processing") of personal data by private entities and public authorities. The GDPR will apply from 25 May 2018, and it contains stricter rules on how a natural or legal person, public authority, agency or other body, processes personal information than the current rules.

​The basic rules on data protection entail that a natural person (i.e. the data subject) has a number of rights and enjoys protection against unauthorised processing of his or her personal information. This means that for example any company, that processes personal data must comply with the basic principles of data processing. The GDPR is introduced to ensure continuous protection of these rights in an increasingly evolving "digital world" that has changed significantly over the past 20 years.

​The new rules apply to all processing of information that may relate to a natural person, and thus to both customer and employee data. In practice, this means that the rules apply to any personal information about customers, employees, job applicants, etc. Anything from basic information, such as for instance name, email addresses and telephone numbers, to sensitive personal information about, for instance, health and trade union memberships, will be covered by the new rules.

​The most significant change is the new concept introduced by the General Data Protection Regulation called 'Accountability'. In practice, this means that companies have to be able to demonstrate that they comply with the terms of the rules; for instance by providing information about their processing and controls implemented to safeguard personal data - in short, a compliance program.

The regulation provides, as starting point, simplification by one set of rules for all processing within the EU/EEA. This standardisation ensures effective operations for companies and unified transparency for the data subjects, which will increase the trust and understanding. There will, however, be some local differences between the different EU/EEA member states.

Nets has reviewed the personal data flows in our services in order to meet the new demands in the regulation and in order for Nets’ customers to be able to document accountability themselves. Where needed we adopted the processing, documentation of the services and/or data processing agreements. We also have reviewed the internal policies and internal governance related to data privacy and updated the procedures to be compliant with the regulation. This includes a Data Protection Group Policy and appointment of a Data Protection Officer.

Nets has assessed the accountability of Nets vendors and has taken the relevant steps to ensure that the new demands in the regulation are implemented by our vendors who are handling the privacy data on behalf of Nets to perform the services. This includes adjusting existing vendor agreements/sub data processor agreements and security requirements to reflect the changes in responsibilities.

​Nets has updated its internal processes and procedures in respect to data privacy to ensure the existing and changed / new services will remain compliant with GDPR. This includes a Data Privacy Impact Assessment process to ensure that privacy risk is assessed and eventual high risks mitigated.

Please visit the public pages of EU:
http://ec.europa.eu/justice/data-protection/reform/index_en.htm
Your local Data Protection authorities also gives guidelines as to the understanding of the GDPR, please visit their public pages.