All the rules in the Regulation are built on the principles in Article 5. If you know them, you can assess most situations yourself.
1. Lawfulness, fairness and transparency
You must have a valid lawful basis (lesson 3). The processing must be fair, and people must be told what happens to their data. Hidden registers are not allowed.
2. Purpose limitation
Data must be collected for specified, explicit and legitimate purposes. It cannot simply be used for something completely different.
Example: A customer gives their telephone number to receive a delivery message. You cannot use the number for marketing without a separate basis for it.
3. Data minimisation
You may only process data that is adequate, relevant and limited to what is necessary. Ask yourself: Do I really need this? A form that asks for date of birth, address and marital status when you only want to send a newsletter confirmation breaks the principle.
4. Accuracy
Data must be accurate and, where necessary, kept up to date. Inaccurate data must be corrected or deleted without delay. A mistake in a personnel file or a customer profile can have serious consequences for the person concerned.
5. Storage limitation
Data must not be kept longer than necessary for the purpose. When the purpose has been achieved and no law requires you to keep the data, it must be deleted or anonymised. Many organisations have retention periods for different types of data. Follow them. Some data must be kept for a long time, for example accounting records under the Bookkeeping Act (bokføringsloven), but that does not mean everything can be left lying around forever.
6. Integrity and confidentiality
Data must be protected against unauthorised access, loss and damage, with suitable technical and organisational measures. This is where your daily behaviour comes in: passwords, locking your screen, care with e-mail and attachments (lessons 5 and 6).
7. Accountability
The controller must be able to show that the rules are followed. This requires documentation: procedures, agreements, training, risk assessments and a record of processing activities (Article 30). Datatilsynet can ask for this documentation during an inspection.
Data protection by design
Under Article 25, new systems and procedures must be built so that data protection is looked after from the start, and so that the most privacy-friendly choice is the default. If you are going to start using a new tool that stores personal data, it should be cleared with the person responsible for data protection before you begin.
An example from the office
An employee in the HR department has an old list of names, national identity numbers and sick leave from a project that ended two years ago. The list sits in a private folder on the desktop. Several principles are broken at once: the purpose is gone (storage limitation), the list contains more than necessary (data minimisation), it is not up to date (accuracy) and it sits outside the approved systems (integrity and confidentiality). The right action is to ask who is responsible for deletion, and follow the organisation's rules on when such data is to be removed.
Rules of thumb for everyday work
- Collect only what you need.
- Use the data only for what it was collected for.
- Do not keep private copies or your own lists outside the organisation's systems.
- Delete what is no longer needed, in line with the organisation's procedures.
- Think: Would the person expect us to do this?