1 Purpose and scope determination
This policy protects information about members, beneficiaries, donors, workers, volunteers and partners in all media. The processing register identifies controller or processor status, the legal basis and the applicable general or special regime, particularly health and financial data governed by sector-specific legislation. (1)
2 Collection and legal basis
Collection is limited to a defined legitimate purpose and necessary, proportionate information. A clear notice explains use, sharing, retention, rights and the request channel. The legal basis is documented; blanket consent must not cover every use or compensate for a missing regulatory condition.
Where consent is the basis, it must be clear, demonstrable and withdrawable according to law, and separate from photography, marketing and research. Representation of minors and legal capacity are checked. Withdrawal does not automatically require deletion of a legally mandatory record; the reason for retaining the required portion is explained.
3 Security and sharing
Data is classified and access granted according to role and need, with encryption, authentication, backups and logs. Identity, health and financial data are prohibited in public tools and examples. Only the minimum is shared through a secure channel with a verified recipient, a defined basis and purpose.
Processor contracts specify instructions, confidentiality, security, sub-processors, incident notification, assistance with rights, and deletion or return. Hosting location, cross-border transfers, their conditions and sectoral exceptions are examined before transfer. A cloud subscription or commercial approval alone does not justify it. (2)
4 Individual rights
Requests for access, correction, erasure, restriction, objection, portability or review of automated decisions are recorded according to the applicable right. Identity is checked using minimal data, legal exceptions considered, and a response provided within the legal period with reasons and an escalation route. No fee or automatic refusal is imposed without a basis.
5 Impact assessment and incidents
An impact assessment precedes high-risk processing, new platforms, extensive sharing or automated technology affecting individuals. Risks, safeguards and responsibility are identified, with regulatory consultation or approval where required. The need to formally appoint a data protection officer is determined under the applicable legal conditions.
Any leak, loss or unauthorised access is reported internally immediately. Evidence is preserved, the incident contained and its impact assessed. Required notifications to individuals and authorities follow the applicable scope and deadline. A single unverified deadline must not be assumed for all data regimes.
6 Retention and review
The retention schedule defines duration, starting point, basis, legal holds and authorised destruction. Processing and permissions are reviewed annually and when circumstances change. Unverified procedural deadlines or executive-regulation details are marked as requiring legal review, without suspending basic safeguards.
References in the approved document
- Federal Decree-Law No. 45 of 2021 on Personal Data Protection, Articles 2, 4–10, 18 and 20–23, according to its scope. This document sets internal implementation controls without changing a higher-level legal requirement or competence.
- Federal Law No. 2 of 2019 and its Executive Regulation where special health legislation applies; the general framework is not automatically applied to excluded matters. This document sets internal implementation controls without changing a higher-level legal requirement or competence.