1. Who is the Data Controller and what are their responsibilities?

The Data Controller determines the purposes and means for how personal data is used. They are responsible for ensuring that the entire operation complies with the GDPR, that adequate security measures are in place, and that all agreements with suppliers reflect the same level of data protection.

2. What is the role of a Data Processor?

A Data Processor handles personal data on behalf of the Data Controller. They strictly follow the instructions provided and are not permitted to make independent decisions regarding data management. Curera can act as both a Controller and a Processor, depending on the specific situation.

3. What is the role of the Data Protection Officer (DPO)?

The DPO primarily acts as an advisor and monitors overall compliance with the GDPR. They are not involved in the daily processing of personal data but assist the organization in identifying risks and ensuring that data protection routines are followed.

4. How is data protection ensured operationally?

All employees have a responsibility to handle personal data correctly. This is achieved through mandatory training, clear processes, checklists, and regular follow-up across various parts of the organization.

5. How are personal data breaches handled?

The company must have a clear incident process which involves:

• Quickly identifying who is responsible for reporting.

• Informing the DPO when necessary.

• Reporting to the Supervisory Authority within 72 hours if the risk to individuals' rights and freedoms is high.

• Following up on measures taken and implementing improvements to prevent future incidents.

6. Does GDPR apply the same rules across the entire EU?

Yes, the GDPR is a common set of laws across the entire EU. However, supplementary national rules may exist, such as the Swedish Data Protection Act.

7. How does GDPR apply when processing data outside the EU?

The GDPR also applies to companies outside the EU that handle data concerning EU citizens. When transferring data to a third country, adequate agreements and security measures are required, in addition to any local legal requirements.

8. Can an entity hold multiple roles within data protection?

Yes. A company can act as both a Controller and a Processor in different parts or contexts of its operation. Roles are defined based on the specific data being handled and the company’s internal structure.

9. How often should data protection be checked and followed up on?

Controls should take place continuously, with regular internal reports, for example, four times per year. Regular follow-up allows the organization to identify shortcomings and improve routines effectively.

10. Who receives information about data protection status and control results?

Information is shared internally with management and the board for follow-up and decisions regarding necessary improvements. This information is part of the internal data protection culture and is not intended to be shared with the general public.