Protecting Your Data
GDPR is the most comprehensive EU data privacy law in decades, and came into effect on May 25, 2018. Besides strengthening and standardizing user data privacy across the EU, it requires new or additional obligations on all organizations that handle EU citizens’ personal data, regardless of where the organizations themselves are located. On this page, we’ll explain our methods and approach to compliance.
Preparing for GDPR
The GDPR’s updated requirements are significant and our team is working diligently ensure Bionic is in compliance. Measures to achieve this include:
- Continuing to invest in security infrastructure
- Changing our policies and product offerings to include tools for data management
We will also continue to monitor the guidance around GDPR compliance from privacy-related regulatory bodies and adjust our plan accordingly.
Commitments as a Data Processor
Data controllers are companies that supply goods or services to EU residents, or that track or monitor EU residents and decide why and how data is collected and processed. Data processors are vendors or businesses that process data on behalf of data controllers. As a Data processor, we are committed to both ensuring our practices are sound within the scope of the GDPR, as well as ensuring we only work with compliant data controllers. In support of this, the following are initiatives we have undertaken:
- Information Audit: As part of the GDPR, we are completing a thorough audit of all data collection, data flows, and data processing within Bionic and between us and our cloud vendors.
- Information Asset Register: From our information audit, we are creating an information asset register. This allows to ensure we are properly tracking, securing, and when applicable, removing user information across our internal systems.
- Vendor Compliance: We are following up with all of our vendors to ensure they are on track to achieve and maintain GDPR compliance.
- Support for Deletion Requests: Bionic has always allowed for users to request deletion of their account and application data. Going forward, we will implement additional product messaging to make this feature more widely known.
- Breach Notification Policy: In line with our current policies, Bionic will promptly inform users of any incidents involving user data.
- Lawful Bases Identification: The GDPR allows for a number of lawful bases for processing data. Bionic is committed to documenting our bases for data processing and will work to inform users in the appropriate manner.
- Product Adjustments: As part of compliance, Bionic will continue to modify the product to ensure we are meeting both regulators’ and users’ expectations under this law.
The GDPR is a complex law, with many best practices yet to be agreed upon. Bionic is committed to following developments in this area and implementing best practices as they emerge in a timely manner. As a company, we believe the new legal requirements will raise the bar for honouring end users’ rights. Resources