{"id":11489,"date":"2022-09-14T16:06:38","date_gmt":"2022-09-14T14:06:38","guid":{"rendered":"https:\/\/azlp.mk\/phases-of-implementation-of-pvzlp\/"},"modified":"2022-11-29T12:48:59","modified_gmt":"2022-11-29T10:48:59","slug":"phases-of-implementation-of-pvzlp","status":"publish","type":"page","link":"https:\/\/azlp.mk\/en\/controllers\/directions\/personal-data-protection-impact-assessment-pdpa\/phases-of-implementation-of-pvzlp\/","title":{"rendered":"Phases of implementation of PVZLP"},"content":{"rendered":"

1. Defining the context<\/strong> – In the first stage, the context of processing is defined and the following information is stated or described:<\/p>\n

    \n
  • collection of personal data,<\/li>\n
  • purpose of the processing,<\/li>\n
  • data movement,<\/li>\n
  • method(s) of obtaining the data,<\/li>\n
  • method and means of data processing (used equipment, networks, human resources, etc.),<\/li>\n
  • entities involved in the processing (controllers, processors, users, etc.),<\/li>\n
  • storage period.<\/li>\n<\/ul>\n

    2. Risk analysis<\/strong> \u2013 In the second phase, the threats (unwanted outcomes) are identified, and the probability and impact (consequence) of the realization of each risk is determined.<\/p>\n

    Risk is expressed as a function of the probability that the undesired outcome (threat) will occur and the impact (consequence) of the undesired outcome if it occurs.<\/p>\n

    \n

    Risk = (Probability of the threat occurring) x (Degree of impact)<\/em><\/strong><\/p>\n<\/div>\n

    The impact can be:<\/p>\n

      \n
    • Low, when individuals can face several minor inconveniences, which they will overcome without a problem (for example: lost time to re-enter data, anxiety, irritation, etc.)<\/em><\/li>\n
    • Medium, when natural persons can face significant inconveniences, which they will be able to overcome despite certain difficulties, (for example: additional costs, refusal of access to certain business services, fear, lack of understanding, stress, minor physical ailments etc.)<\/em><\/li>\n
    • High, when natural persons can face significant consequences, which they should be able to overcome, but with serious difficulties, (for example: misappropriation of funds, blacklisting by financial institutions, damage to property, loss of employment, subpoena, deterioration of health, etc.)<\/em><\/li>\n
    • Very high, when natural persons can face significant and even irreversible consequences, which they are unlikely to be able to overcome (for example: inability to work, long-term psychological or physical illness, death, etc.)<\/em> .<\/em><\/li>\n<\/ul>\n

      The risk assessment is carried out according to the basic principles of personal data protection.<\/p>\n

      3. Risk management<\/strong> – The third phase should include protective measures, security measures and mechanisms designed to reduce the risk to an acceptable level, ensure the protection of personal data and demonstrate compliance with the regulations for the protection of personal data.<\/p>\n

      The measures, just like the risk assessment, should be divided according to the basic principles of personal data protection.<\/p>\n

      4. Compilation of a report from an implemented EPA<\/strong> – The controller documents all stages of implementation of the EPA, after which he prepares a report.<\/p>\n

      The report of the implemented PPE contains in particular: description of the processing process, internal and external persons involved in the process of implementation of the PPE, risk analysis, defined risk management measures, summary\/conclusion, action plan, opinion of the officer and other persons involved in the process, approval of the PVZLP by the responsible person at the controller.<\/p>\n<\/div><\/div>