CAFM & IT
The following checklist will help FMs evaluate their existing visitor check-in system for GDPR compliance:
Do you only collect client data that you absolutely need? (data minimisation) Any data you collect needs to pass the test of asking yourself whether there is a way to achieve the purpose without collecting the data. Even better, if you can tailor the check-in process to different profiles of visitors, you can ensure that you always only ask for the information you absolutely need.
When collecting your visitor data, do you ask their permission (consent) and explain how you will use it? You must demonstrate that your visitors explicitly agreed to the processing of their data for specific purposes. Again, this can be achieved by allowing them to confirm reading the privacy policy, or by offering a toggle switch by which they allow you to store their data on your VMS.
If one of your visitors changes their mind and no longer
wants you to keep their data, is this easy to undo? Your organisation must allow visitors to say at any point that they no longer want you to store their visit data and revoking consent to store their data should be as
www.tomorrowsfm.com
easy as giving it. You will find that the GDPR-compliant VMS offers this by way of a toggle that allows visitors to change their mind during their subsequent visits.
Do you store visit details for no longer than what is needed? One way to tackle the question of data retention is to allow bulk selection and deletion of visits in the dashboard. A more elegant solution for this is automatic deletion after a specified number of days. Ideally, your VMS will either have this feature or be built to easily integrate it in near future.
Did you sign a Data Processing Agreement? Your VMS provider must provide assurances that they comply with the GDPR stipulations in all applicable aspects detailed in Article 28, as well as the related provisions of articles 32 to 36. In practice, this implies that you have a binding written agreement, also called a Data Processing Agreement (“DPA”) in place, ensuring a strict level of safety and security of the personal data processed on your behalf.
TOMORROW’S FM | 45
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36 |
Page 37 |
Page 38 |
Page 39 |
Page 40 |
Page 41 |
Page 42 |
Page 43 |
Page 44 |
Page 45 |
Page 46 |
Page 47 |
Page 48 |
Page 49 |
Page 50 |
Page 51 |
Page 52 |
Page 53 |
Page 54 |
Page 55 |
Page 56 |
Page 57 |
Page 58 |
Page 59 |
Page 60 |
Page 61 |
Page 62 |
Page 63 |
Page 64 |
Page 65 |
Page 66
