Das Datenschutzgesetz contains a number of requirements for companies that process personal data. These include, among other things, the obligation to publish a privacy policy, to respect the data privacy rights of the data subjects, and to ensure data security. In the following article, you will learn who the new Datenschutzgesetz applies to, what personal data are, and what a privacy policy is.
For whom does the Datenschutzgesetz apply?
Das neue Datenschutzgesetz and its Verordnung apply when it comes to the processing of personal data by natural and legal persons, including federal authorities. Private individuals who process personal data only for their own use are in principle exempt from compliance with data protection requirements. This exception "for personal use" refers only to the processing of data in the closest personal and family environment (i.e. data of close family members and friends). Public websites normally do not fall under the category “for personal use” - even if they are run by a private individual. Therefore, private website operators, just like commercial ones, are regularly affected by the new provisions of the Datenschutzgesetz and the Datenschutzverordnung.
What does “processing of personal data” mean?
According to the new Datenschutzgesetz, personal data means all information relating to an identified or identifiable natural person. This includes, for example, name, address, telephone number, date of birth, or even an IP address. Processing encompasses any handling of personal data, regardless of the means and procedures applied, in particular the retaining, disclosing, acquiring, collecting, deleting, storing, modifying, destroying, and using of personal data. Data protection law does not protect the data itself, but the individuals behind it, whose data are being processed.
What is a privacy policy?
A privacy policy is a document. It describes what information the company collects, how this data is processed and for what purposes it is used. It also explains whether this data is forwarded to other people, companies, and/or third parties. In addition, it outlines the steps the company takes to protect the privacy of its clients and who within the company is responsible for data processing.
Why is a privacy policy needed?
The privacy policy is necessary to ensure transparency. It explains to visitors of a website what personal data is collected and why it is used. It also shows whether and what data is shared with other people. Simply put, visitors must receive sufficient and easy-to-understand information about what personal data is collected and what happens to it, so that they can decide for themselves whether and how they want to disclose their data. Furthermore, users must get all necessary information to enforce their rights. Therefore, the policy should be written with care, accuracy, and in a language that visitors can easily understand. If the website is available in several languages, the privacy policy should also be in those languages.
When do I need a privacy policy?
A privacy policy is necessary wherever personal data is collected and/or processed. This includes in particular:
Websites
Newsletters
Contracts with private individuals
Marketing campaigns
Conclusion
The revised Datenschutzgesetz strengthens the rights of affected persons and places higher requirements on companies that process personal data. In particular, small and medium-sized enterprises should review their internal processes and documentation for the new guidelines. Violations can also have criminal consequences for responsible persons in the future. By acting early, you not only reduce legal risks but also strengthen the trust of your clients.
The creation of a privacy policy can become a time-consuming and complex challenge. For this reason, we have developed a solution that makes the process as easy as possible for you.
