GDPR Compliance Policy

Data Protection Principles

• Lawfulness: All processing based on legitimate legal grounds with clear lawful bases;
• Purpose Limitation: Data processed only for specific, explicit research purposes;
• Data Minimisation: Only necessary data collected for stated research objectives;
• Accuracy: Procedures to ensure data accuracy and correction mechanisms;
• Storage Limitation: Data retained only as long as necessary for research purposes;
• Security: State-of-the-art technical and organizational security measures;
• Accountability: Comprehensive documentation and audit trails maintained.

Technical Safeguards

• End-to-end encryption for all data transmission (TLS 1.3);
• AES-256 encryption for data at rest with hardware security modules;
• Data centers located within the EU with strict access controls;
• Multi-factor authentication and role-based access controls;
• Regular penetration testing and security audits;
• Automated data loss prevention and monitoring systems;
• Secure backup and disaster recovery procedures;
• Privacy-preserving analytics and pseudonymization capabilities.

Organizational Measures

• ISO 27001 certified information security management system;
• SOC 2 Type II compliance for service organization controls;
• Regular staff training on data protection and research ethics;
• Data Protection Impact Assessments (DPIAs) for high-risk processing;
• Incident response team with 24/7 breach detection capabilities;
• Privacy-by-design principles integrated in development lifecycle;
• Regular compliance audits and third-party assessments.

Data Controller Responsibilities

• Researchers and institutions act as data controllers for collected research data;
• Responsibility for obtaining valid informed consent from research participants;
• Ensuring appropriate legal basis for processing (consent, legitimate interest, etc.);
• Maintaining ethics approval documentation and compliance records;
• Determining data retention periods based on research and regulatory requirements;
• Responding to data subject rights requests from research participants;
• Implementing additional security measures for sensitive data categories.

FIRAT as Data Processor

• Processes research data strictly according to researcher instructions;
• Provides secure infrastructure and technical safeguards;
• Assists with data subject rights fulfillment within technical capabilities;
• Maintains detailed processing logs and audit trails;
• Ensures subprocessor compliance with GDPR requirements;
• Supports data portability and export functionality;
• Implements data retention and deletion procedures as instructed.

Data Subject Rights Support

• Technical tools to facilitate access requests and data portability;
• Automated systems for data rectification and updates;
• Secure deletion capabilities with cryptographic verification;
• Consent management tools for research participant consent tracking;
• Audit trails for all data processing activities and changes;
• Integration with institutional consent management systems;
• Support for pseudonymization and anonymization techniques.

Transfer Mechanisms

• EU-UK Trade and Cooperation Agreement for UK transfers;
• Standard Contractual Clauses (SCCs) for non-adequate countries;
• Adequacy decisions where available (Japan, Canada, etc.);
• Binding Corporate Rules for multinational research organizations;
• Article 49 derogations for specific research situations;
• Additional safeguards for sensitive research data transfers.

Data Localization Options

• EU-only data processing option for maximum protection;
• Specific country restrictions available upon request;
• Real-time data location tracking and reporting;
• Geographic backup and disaster recovery controls;
• Compliance with local data residency requirements;
• Researcher control over data transfer permissions.

Detection and Response

• 24/7 automated monitoring and anomaly detection systems;
• Incident response team activated within 1 hour of breach detection;
• Immediate containment and forensic investigation procedures;
• Risk assessment and impact analysis within 24 hours;
• Coordinated response with affected researchers and institutions.

Notification Procedures

• Supervisory authority notification within 72 hours (Article 33 GDPR);
• Data controller notification within 24 hours of breach detection;
• Data subject notification when high risk to rights and freedoms exists;
• Clear communication about breach scope, potential impact, and mitigation measures;
• Regular updates throughout investigation and remediation process;
• Post-incident report with lessons learned and preventive measures.

Rights Management Portal

• Self-service portal for data subjects to exercise their rights;
• Automated identity verification and consent tracking;
• Real-time status updates on rights requests processing;
• Integration with researcher workflow management systems;
• Audit trails for all rights-related activities and decisions.

Technical Implementation

• Right of Access: Automated data export in machine-readable formats;
• Right to Rectification: Direct editing capabilities with audit trails;
• Right to Erasure: Cryptographic deletion with verification;
• Right to Portability: Standardized data export (JSON, CSV, XML);
• Right to Restrict Processing: Processing flags and access controls;
• Right to Object: Opt-out mechanisms and consent withdrawal;
• Rights related to Automated Decision-making: Human review processes for AI.

• Urgent matters: Within 24 hours
• Rights requests: Within 30 days (extendable to 90 days for complex requests)
• General inquiries: Within 5 business days
• Breach notifications: Within 72 hours to authorities, immediately to controllers