Externe/en

Externals in the context of data protection are external legal or natural entities, meaning companies or people, who receive personal data from your company or transmit them to you. The management of those externals is fundamental for GDPR compliance. As a company, you must be able to give information about which externals you have received personal data from and which externals you transmit them to. In a processing activity, there's a record of which externals give and receive which data, respectively, which allows you to fulfill the duty to disclose.

As a data protection expert or professional, you can see all external companies and persons created in the data protection management system under "Data protection → Externals".

You can also create new externals or edit existing ones here.

Overview of externals

Create/edit externals

To create an external, click the "Plus" button in the overview.

To edit an external, double-click on the name in the overview.

Create/edit external

Caution: Once created, externals can no longer be deleted. They can only be changed from active to deactivated.

Abbreviation and designation:

• Abbreviation: internal abbreviation of the external party.
• Designation: e.g. name of the company or person that receives personal data.

Description: Here, you explain what function the external performs.

Industry: The industry in which the external is active.

Is responsible for processing activity: Must be enabled for the external to be displayed in the selection for Responsible in a processing activity.

Recipient not in EU: If the recipient is not located in the EU, this must be marked. In addition, appropriate safeguards must also be specified for this case, so that these externals may receive personal data compliant with the General Data Protection Regulation.

Recipient is a processor: "Processor" can be a natural or legal person, a government agency, institution, or other entity that processes personal data on behalf of your company. In the course of this, you must provide information about the scope of this processing and upload documents such as contracts and agreements with the processor.

Purpose and legal basis: The transmission to certain categories of recipients are often based on a previously determinable purpose and legal basis for the transmission to this category of recipients. Record standardized purpose and legal basis here, in order to automatically take over this information in processing activities. They can afterwards be manually modified in individual processing activities.

Address: The address of the external.

Contact: Contact details of the external.

Contact person: The contact person with the external.