Main obligations of controllers in the processing of personal data

The responsibility principle

The main obligation of the controller is to ensure that all processing of personal data carried out by him is in accordance with the data protection laws and he must be able to demonstrate that he has strictly observed the above.

This includes, for example, taking care that:

• the processing is based on the authorization in the law and that obligations relating to the rights of individuals are fulfilled.

• processing complies with the principles of the data protection legislation and that compliance can be demonstrated.

The controller must therefore examine each principle individually and assess the requirements the data protection legislation makes in order to ensure compliance.

In any case, the controller must take into account the nature of the information. In this regard, he must examine:

• whether the information is general, sensitive or of sensitive nature

• how much information is intended to be processed

• why he intends to process the information.

For example, the controller must take more extensive measures in the case of processing large quantities of sensitive personal data or in the case of creating a personal profile or making automatic decision-making.

In addition, it is necessary to take into account the risks that the processing in question can pose for the rights and freedoms of the individual, to the protection of personal data and privacy.

Processing that can affect whether or not a person receives a particular service has for example been assessed as risky.

Special obligations are on the responsible party if he or she works with.

How does the controller demonstrate that he has fulfilled his obligation to be responsible?

He can do that, for example, by:

• documents, such as a filings

• by carrying out an Data Protection Impact Assessment

• with documentation of specific procedures.

The controller must also be able to demonstrate the effectiveness of the measures that he has decided to apply, for example by recording irregularities and other things.