Your rating 0 from 0 votes
В началото на м.май 2016 г. беше публикувана новата правна рамка на ЕС за защита на личните данни, която включва:
- Общ Регламент за защита на личните данни (ЕС) 2016/679
- Директива за защита на личните данни в полицейската и наказателната дейност
- Директива за използването на резервационните данни на пътниците
- Новата правна рамка ще се прилага от края на м.май 2018 г., като дотогава, всяка от страните – членки на ЕС:
- следва да ревизира действащата вътрешна правна уредба на защитата на личните данни и да приеме надлежни изменения, допълнения и отмѐни, с оглед прякото приложение във вътрешното й право на новия Общ европейски Регламент за защита на личните данни;
- като част от тази ревизия, да определи/създаде свой "надзорен орган" (supervisory authority), като нейн независим публичен орган за прякото приложение във вътрешното ѝ право на новия Общ европейски Регламент за защита на личните данни, както и
- да транспонира двете Директиви в своето национално право .
От своя страна – досегашните администратори на лични данни , а вече и обработващите лични данни (processors) , следва да приведат дейността си в съответствие с Общия Регламент, като за целта е подходящо:
- да проучат подробно новата правна рамка и откроят новото и различното, което се отнася конкретно до тяхната дейност;
- да одитират актуалното състояние на защитата на личните данни в своята структура, като оценят всички организационни, административни, технически, кадрови и др. аспекти и идентифицират областите, които представляват най-голям риск за техния бизнес;
- на такава основа, да предприемат подходящите систематични стъпки за минимизиране или преодоляване на тези рискове в периода до старта на приложението на правната рамка, като предвидят и нужните за това ресурси (организационни, кадрови, финансови);
- заедно с това, да спазват стриктно съществуващите свои задължения съгласно действащото законодателство до старта на приложение на новата правна рамка.
Основни промени, след прилагане на GDPR, и техният ефект върху бизнеса
- Териториален обхват: GDPR ще се прилага и в трети страни спрямо администратори и лица обработващи лични данни на европейски граждани.
- Задължение за искане на съгласие за обработка и съхранение на лични данни.
- Съгласие от непълнолетни при ползване на "онлайн" услуги.
- Права на физическите лица при предоставяне на личните си данни.
- Правото да бъдеш забравен Субектът на данните получава право, което му позволява да поиска, от администратора на лични данни, изтриване на личните данни и да се прекрати по-нататъшното им разпространение и обработка на данните.
- Преносимост на данните.
- Задължение за уведомяване на Компетентния надзорен орган (КНО). GDPR въвежда задължение за уведомяването на КНО при установени нарушения, свързани със сигурността на личните данни.
- Административни наказания до 20 000 000 EUR или до 4 % от общия годишен световен оборот на организацията.
- Сигурност: Използването на технически и организационни механизми, от администратори и обработващи лични данни, осигуряващи сигурността на данните ще бъде законово изискване след 25 май 2018 г.
- Назначаване на длъжностно лице по защита на данните (Data Protection Officer - DPO).
- Сътрудничество между компетентни орган на ЕС и надзорните органи на държавите-членки.
- Инструменти за демонстриране на изпълнението на GDPR.
GDPR обхваща различни аспекти от дейностите на една организация. Основните изисквания трябва да бъдат покрити от правните и ИТ отделите на компаниите. Като цяло изискванията в посока на обезпечаването на информационната сигурност на ИТ системите са комплексни и обхващат политиките за информационна сигурност в дадената организация.
14 results found for "GDPR" in pages:
About usGDPR... CONSEJO Ltd. is a consulting company with more than 20 years of practical experience in the development, implementation and maintenance of management systems and in supporting organizations in achieving compliance with international standards and reg...
Implementation of the GDPR (Regulation 2016/679)GDPR compliance. GAP analysis During the GAP analysis, an assessment of the current level of compliance of the processes in the organization with the requirements of GDRR is performed. Our consultants participate both in the assessment ...
Data protection officerGDPR) and the Personal Data Protection Act (PDPA), we offer as a service the opportunity to be your DPO. DPO can be an employee of a personal data controller or a person external to the personal data controller charged with advisory functions in the ...
Implementation of a regulatory requirementGDPR... THE STAGES OF CONSULTATION FOR THE IMPLEMENTATION OF A REGULATORY REQUIREMENT CAN BE CONVENTIONALLY DIVIDED INTO: GAP analysis and evaluation of the current level of compliance; Preparation of rules and procedures for fulfilling the requirement...
ISO/IEC 27017:2015 Code of practice for information security controlsGDPR. Key Features of ISO/IEC 27017 ISO/IEC 27017 offers specialized guidance and controls for managing cloud security. Its key features include: 1. Additional Controls and Guidance for Cloud Services The standard enhances ISO...
ISO/IEC 27018 Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processorsGDPR, depending on the specific processing context and assigned roles. It is important to note that implementation of ISO/IEC 27018 alone does not guarantee GDPR compliance; however, it provides a strong foundation for establishing effec...
ISO/IEC 27032 Guidelines for Internet securityGDPR, Cybersecurity laws, and other legal requirements. Increased trust: Demonstrates a commitment to cybersecurity, strengthening trust among customers and partners. Steps to Implement ISO/IEC 27032 in your organization? Risk Assessment...
ISO/IEC 42001 Artificial intelligenceGDPR processes, including the connection between the AI system impact assessment and the data protection impact assessment, or DPIA; an integrated ISO/IEC 27001 + ISO/IEC 42001 system is possible, with common processes and a combined certification ...
ISO/IEC 27701 Information security, cybersecurity and privacy protectionGDPR); • identify and manage risks associated with the processing of personal data; • implement privacy policies, procedures, and controls. Purpose and Scope The main objective of ISO/IEC 27701:2025 is to provide organizati...
GDPR (General Data Protection Regulation)GDPR) – on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, a unified legal framework has been established to harmonize the legislation pro...
Law on the Protection of Persons Reporting BreachesGDPR... In 2023, the Law on the Protection of Persons Reporting or Publicly Disclosing Information on Breaches was introduced into Bulgarian legislation. The Law transposes the requirements of Directive (EU) 2019/1937 on the protection of persons who re...
TISAX (Trusted Information Security Assessment Exchange)GDPR... What is TISAX? TISAX (Trusted Information Security Assessment Exchange) is a mechanism for assessing and mutually recognising information security assessment results within the automotive industry. TISAX was developed on the initiative of the Ger...
NIS2 (DIRECTIVE (EU) 2022/2555)GDPR... Directive (EU) 2022/2555 of the European Parliament and of the Council on measures for a high common level of cybersecurity across the Union is a legislative act aimed at achieving a high common level of cybersecurity throughout the European Union. ...
Cybersecurity, Information SecurityGDPR SOC 2 TISAX An information security management system (ISMS) will also ensure the provision of business continuity in case of emergency and crisis. ...
16 results found for "GDPR" in news:
Why ISO Standards Are Becoming Crucial in Public ProcurementIn recent years, the requirements imposed on participants in public procurement procedures have become increasingly stri...
Key Changes in International Standards and Regulatory Requirements in 20252025 established itself as a year of significant change in the fields of management standards, information security...
ISO/IEC 42005:2025 – a standard for assessing the impact of artificial intelligence systemsWith the increasing deployment of artificial intelligence (AI) systems in key public and business processes, issues rela...
ISO/IEC 27701:2025 — A New Era in Privacy ManagementISO/IEC 27701:2025 – Information security, cybersecurity and privacy protection — Privacy information manage...
ISO/IEC 27701:2025 – The New Standard for Privacy, AI and Cloud TechnologiesOn 14 October 2025, the International Organization for Standardization (ISO) officially released the second edition of...
ISO/IEC 27018:2025 – Enhanced Protection of Personal Data in the CloudAugust 2025 – The International Organization for Standardization (ISO) and the International Electrotechnic...
ISO/IEC 27018:2025: Updated Guidelines for PII Protection in Cloud EnvironmentsIn August 2025, the third edition of the standard ISO/IEC 27018:2025 – "Information security, cybersecurity a...
NEW: Network and Information Security Specialist as a ServiceDouble the Power for Your Information Security With over a decade of consultancy experience and dozens of successfu...
Amendments to the Law on the Protection of Persons Reporting BreachesIn the State Gazette, Issue No. 38 of 2025, amendments and supplements to the Law on the Protection of Persons Reporting...
Impact Analysis of Cyber AttacksWhether it’s an attempt to breach the network or a complete shutdown of information systems, cyber-attacks are hig...
How NIS 2 relates to ISO/IEC 27001Directive (EU) 2022/2555 aims to strengthen cybersecurity in the member states of the European Union and will come ...
What is ISMS and why do you need it?Today, every organisation faces threats such as hacking, ransomware and careless data handling. An Information Security ...
Differences between NIS and NIS 2 directivesThe European Union's cybersecurity rules, introduced in 2016, have been updated by Directive (EU) 2022/2555 of ...
Regulatory Cybersecurity Obligations of Municipal EnterprisesMunicipal enterprises (including municipal companies and structures providing public services) increasingly manage criti...
A new standard has been published to support the privacy information managementThe world we live in today is more connected than ever, and digital technologies have their benefits and risks. Cybersec...
An Updated Version of ISO/IEC 27005 – Information Security Risk Management Has Been
PublishedProtecting corporate information, whether commercially sensitive information or customers’ personal data, is incre...
News
12
10.26
NATO Quality Assurance Standards Gain Attention in Defence Industry Investment
NATO quality assurance requirements are of practical importance to Bulgarian com...
25
09.26
European Cybersecurity Month 2026: The Human Factor in Focus
Today, the Court of Justice of the European Union in Luxembourg is hosting the o...
Accents
06
11.26
AQAP-2110: Beyond ISO 9001 Requirements
What additional requirements apply to suppliers in the defence industry?
For ...
20
10.26
Change Management in the Food Sector: When Is a New Risk Assessment Necessary?
Changing a supplier may seem like a routine commercial decision, while extending...
Implementation of management standards
CONSEJO Ltd. is a consulting company with over 20 years of practical experience in the development, implementation and maintenance of management systems in accordance with international standards and regulatory requirements. The company provides consulting services in the areas of quality management, environmental management, occupational health and safety, food safety, information security, cybersecurity, risk management and sustainable development. Our expertise covers standards and schemes such as ISO 9001, ISO 14001, ISO 45001, ISO 22000, ISO/IEC 27001, IFS Food, BRCGS and HACCP, as well as consulting services related to NIS2, DORA, GDPR and EcoVadis.
The CONSEJO team has been involved in over 1,500 projects for organizations across various sectors of the economy, including manufacturing, construction, energy, information technology, transport, trade, the food industry and services. Our approach focuses on developing management systems that work effectively in practice, tailored to the specific characteristics and needs of each organization. We work closely with our clients, providing consulting support, staff training and assistance during implementation. We strive to deliver high-quality services within the agreed deadlines and solutions that support successful certification and create long-term value for businesses.
Partners
