interactive GDPR 2016/0679 EN

(a)

the purposes of the processing;

(b)

the categories of personal_data concerned;

(c)

the recipients or categories of recipient to whom the personal_data have been or will be disclosed, in particular recipients in third countries or international_organisations;

(d)

where possible, the envisaged period for which the personal_data will be stored, or, if not possible, the criteria used to determine that period;

(e)

the existence of the right to request from the controller rectification or erasure of personal_data or restriction of processing of personal_data concerning the data subject or to object to such processing;

(f)

the right to lodge a complaint with a supervisory_authority;

(g)

where the personal_data are not collected from the data subject, any available information as to their source;

(h)

the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

(a)

the name and contact details of the controller and, where applicable, the joint controller, the controller's representative and the data protection officer;

(b)

the purposes of the processing;

(c)

a description of the categories of data subjects and of the categories of personal_data;

(d)

the categories of recipients to whom the personal_data have been or will be disclosed including recipients in third countries or international_organisations;

(e)

where applicable, transfers of personal_data to a third country or an international_organisation, including the identification of that third country or international_organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards;

(f)

where possible, the envisaged time limits for erasure of the different categories of data;

(g)

where possible, a general description of the technical and organisational security measures referred to in Article 32(1).

(a)

the name and contact details of the processor or processors and of each controller on behalf of which the processor is acting, and, where applicable, of the controller's or the processor's representative, and the data protection officer;

(b)

the categories of processing carried out on behalf of each controller;

(c)

where applicable, transfers of personal_data to a third country or an international_organisation, including the identification of that third country or international_organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards;

(d)

where possible, a general description of the technical and organisational security measures referred to in Article 32(1).

(a)

to order the controller and the processor, and, where applicable, the controller's or the processor's representative to provide any information it requires for the performance of its tasks;

(b)

to carry out investigations in the form of data protection audits;

(c)

to carry out a review on certifications issued pursuant to Article 42(7);

(d)

to notify the controller or the processor of an alleged infringement of this Regulation;

(e)

to obtain, from the controller and the processor, access to all personal_data and to all information necessary for the performance of its tasks;

(f)

to obtain access to any premises of the controller and the processor, including to any data processing equipment and means, in accordance with Union or Member State procedural law.

(a)

to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of this Regulation;

(b)

to issue reprimands to a controller or a processor where processing operations have infringed provisions of this Regulation;

(c)

to order the controller or the processor to comply with the data subject's requests to exercise his or her rights pursuant to this Regulation;

(d)

to order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period;

(e)

to order the controller to communicate a personal_data breach to the data subject;

(f)

to impose a temporary or definitive limitation including a ban on processing;

(g)

to order the rectification or erasure of personal_data or restriction of processing pursuant to Articles 16, 17 and 18 and the notification of such actions to recipients to whom the personal_data have been disclosed pursuant to Article 17(2) and Article 19;

(h)

to withdraw a certification or to order the certification body to withdraw a certification issued pursuant to Articles 42 and 43, or to order the certification body not to issue certification if the requirements for the certification are not or are no longer met;

(i)

to impose an administrative fine pursuant to Article 83, in addition to, or instead of measures referred to in this paragraph, depending on the circumstances of each individual case;

(j)

to order the suspension of data flows to a recipient in a third country or to an international_organisation.

(a)

to advise the controller in accordance with the prior consultation procedure referred to in Article 36;

(b)

to issue, on its own initiative or on request, opinions to the national parliament, the Member State government or, in accordance with Member State law, to other institutions and bodies as well as to the public on any issue related to the protection of personal_data;

(c)

to authorise processing referred to in Article 36(5), if the law of the Member State requires such prior authorisation;

(d)

to issue an opinion and approve draft codes of conduct pursuant to Article 40(5);

(e)

to accredit certification bodies pursuant to Article 43;

(f)

to issue certifications and approve criteria of certification in accordance with Article 42(5);

(g)

to adopt standard data protection clauses referred to in Article 28(8) and in point (d) of Article 46(2);

(h)

to authorise contractual clauses referred to in point (a) of Article 46(3);

(i)

to authorise administrative arrangements referred to in point (b) of Article 46(3);

(j)

to approve binding_corporate_rules pursuant to Article 47.