2

I would like to know how the gdpr applies to software companies/houses. What aspects or workings of software companies need gdpr compliance? And what is the sort of personal information they gather that requires them to comply with gdpr?

Id be grateful if anyone could cater to these questions.

1
  • Welcome to Law StackExchange. This question is very broad. Can you narrow down your question to specific aspects of the GDPR? There are also a large number of existing questions and answers about GDPR here that you might want to browse through. Apr 28, 2018 at 16:07

1 Answer 1

1

The regulation concerns the processing of personal data, so all aspects relating to that fall under the regulation (2016/679). Definitions are in Article 4. Because of the order of the first two definitions, we will consider your last question first.

what is the sort of personal information they gather that requires them to comply with gdpr?

Article 4, paragraph (1):

(1) ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

The preceding question:

What aspects or workings of software companies need gdpr compliance?

Article 4, paragraph (2):

(2) ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

The regulation is long and complicated, so there are many exceptions to its broad principles, but its approach is essentially to establish broad requirements and then carve out exceptions under certain circumstances, meaning that someone evaluating a data processor's compliance with the regulation would have to look at nearly everything they do.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .