GDPR compliance for a small company
Korhonen, Sonja (2025)
2025
All rights reserved. This publication is copyrighted. You may download, display and print it for Your own personal use. Commercial use is prohibited.
Julkaisun pysyvä osoite on
https://urn.fi/URN:NBN:fi:amk-2025052013437
https://urn.fi/URN:NBN:fi:amk-2025052013437
Tiivistelmä
The objective of this thesis was to analyse the privacy compliance practices of a small company. The company requested a privacy audit and notice. Adhering to GDPR regulations is a requirement for all-EU based companies. This project aimed to provide recommendations for the company to help them to be more compliant.
The theoretical framework used was the General Data Protection Regulation (GDPR), as the company is based in two EU member countries. The research methods included the collection of primary data, observation of the current workflows and practices, review of existing documentation and the analysis and development of best practices accordingly.
The key findings were the lack of documentation, and how the company website omitted to collect consenting information. The defects were rectified as a result of this project, and the privacy notice was placed on the company website. The recommendation was to create clear written instructions for the employees for correct data handling and retention practices, a record of processing activities, data breach situations and a listing of third-party processors.
The theoretical framework used was the General Data Protection Regulation (GDPR), as the company is based in two EU member countries. The research methods included the collection of primary data, observation of the current workflows and practices, review of existing documentation and the analysis and development of best practices accordingly.
The key findings were the lack of documentation, and how the company website omitted to collect consenting information. The defects were rectified as a result of this project, and the privacy notice was placed on the company website. The recommendation was to create clear written instructions for the employees for correct data handling and retention practices, a record of processing activities, data breach situations and a listing of third-party processors.