GDPR (General Data Protection Regulation)

The General Data Protection Regulation applies directly in all member states and governs how personal data may be collected, used, stored and shared. Personal data is any information about an identifiable person, so a sole trader's name and address on an invoice, an employee's payroll record or a customer's e-mail all fall within it. The business that decides why and how data is processed is the controller; a service provider acting on its instructions is a processor.

Core obligations include a lawful basis for each processing purpose, transparency towards the individuals, data minimisation, security measures, breach notification within 72 hours and respect for the rights of access, rectification and erasure. Accounting records have a lawful basis in legal obligation and may be kept for the retention period despite an erasure request. Transfers outside the EEA need safeguards such as standard contractual clauses. Kontevia acts as a processor for the accounting data of its users under a data processing agreement.