Control Strategy GDPRAtSubject

(empty)

D.GDPR.DFHuoO.1

Personal data Data related to DataSubject transferred across borders: since the data subject DataSubject is subject to the GDPR, their data Data should not be communicated by process FlowsFrom across a border to process Process in jurisdiction RemoteJurisdiction unless the GDPR is in force or equivalent protection is provided.

D.GDPR.DSHuoO.1

Personal data Data related to DataSubject is communicated across borders: since the data subject DataSubject is subject to the GDPR, their data Data it should not be communicated via process Process in jurisdiction RemoteJurisdiction that does not enforce the GDPR or equivalent protection, without suitable protection measures.

D.GDPR.HuDP-St.1

Personal data Data has no data controller: under the GDPR, a data controller (a person or in most cases, an organisation) who alone or jointly with others, determines the purposes and means of the processing of personal data, and has certain responsibilities defined by Article 24. Data Data relates to the data subject DataSubject and is subject to the GDPR so there should be a controller. Add an organisation or user if not already included, and a hasController relationship from Data to its data controller.

D.GDPR.HuDSH-St.1

Personal data Data has no data controller: under the GDPR, a data controller (a person or in most cases, an organisation) who alone or jointly with others, determines the purposes and means of the processing of personal data, and has certain responsibilities defined by Article 24. Data Data relates to the data subject DataSubject and is subject to the GDPR, so there should be a controller. Add an organisation or user if not already included, and a hasController relationship from Data to its data controller.

H.GDPR.HuDSHoJoSt.1

Personal data Data should be stored in a suitable location: since Data relating to DataSubject is subject to the GDPR, it should be stored in a device in a GDPR-compliant jurisdiction or run by a Privacy Shield approved operator. If neither of these regulatory/contractual solutions are available, you need to store the data on a different device.

P.GDPR.HuDoPS-o.6

Lack of legal basis to store Data related to DataSubject at Service: since data Data is related to a person DataSubject who is a citizen or resident in a state where the GDPR applies, a legal basis is required to collect and process their data. In this case the subject controls a process that is using the data, but not the service where it is stored, so consent is still needed to manage the data on their behalf.

P.GDPR.HuDPoJoSt.1

Personal data Data related to DataSubject should be processed in a suitable location: since Data relating to DataSubject is subject to the GDPR, it should be processed in a GDPR-compliant jurisdiction or by a Privacy Shield approved operator. If neither of these regulatory/contractual solutions are available, you need to move the process to a different host, or move the host.

P.GDPR.HuDPoS-i.6

Lack of legal basis for use of Data related to DataSubject by Process: since the data is related to a person DataSubject who is a citizen or resident in a state where the GDPR applies, a legal basis is required to process the data. Since DataSubject controls the device where the data is stored, this can only be by consent or to protect vital interests if incapacitated.

P.GDPR.HuDPS-io.6

Lack of legal basis for use of Data related to DataSubject by Process: since the data is related to a person who is a citizen or resident in a state where the GDPR applies, a legal basis is required to process the data.

SubjectToGDPR at Role_DataSubject