Areas Data Protection

European Regulation No. 2016/679 approving the General Data Protection Regulation and Law 58/2019 of 8 August 2019 oblige private sector entities (including the financial and industry sectors) and the public sector to undertake a series of additional obligations, which are dependent on specialised knowledge in this field, "internalising" in such entities the responsibility for complying with the rules and granting regulators very extensive supervisory powers that may lead to the application of fines of unprecedented amounts.

Also worthy of attention is the obligation to immediately notify data subjects and the Regulator of breaches of data privacy security (data breaches) and the obligation to keep an up-to-date record of processing activities. The Regulation also establishes, for most private sector entities and all public sector entities, the obligation to hire a Data Protection Officer with specialised knowledge of data protection law and practices, a service that can be outsourced.

These compliance obligations may affect the daily activity of organisations and, if approached without due consideration, may pose a risk to the achievement of an organisation's objectives. It is therefore becoming increasingly necessary to consider the entire framework of obligations, with specialised and multidisciplinary knowledge, in order to integrate the practice of data protection with the other entities’ requirements such as transparency obligations, direct marketing and electronic communications, determining the target audience for financial products, identifying, managing and preventing conflicts of interest and money laundering, among others.