7-A07 - GDPR 1125.pdf

The General Data Protection Regulation (GDPR) is a regulation that protects the personal data and privacy of individuals in the European Union (EU). This questionnaire must be completed by departments or programs that are storing, processing, or otherwise utilizing any personal data of individuals in the EU to ensure that current processes comply with GDPR.

Compliance with GDPR requirements is triggered for individuals when they are located in the EU and is not required for EU citizens/residents when they are located in the United States. Additionally, the regulation can be applicable to a U.S. citizen located in an EU country; residency or citizenship in an EU country is not required for applicability of the regulation.

We ask that you respond to each question to the best of your knowledge. If you have questions about this form, contact Information Security at GRC@uthscsa.edu or 210-567-0707.

Your Name:

Job Title:

E-mail Address:

Work Phone:

Name of Department:

Today’s Date:

Section 1: Scope of Personally Identifiable Information

1. Do you maintain information about European residents or others who are permanently or temporarily located in the EU? Yes No If yes, please describe.

APPENDIX ____________

GDPR Questionnaire

2. What personally identifiable information do you maintain or use in your EU-related activities? (Examples include student data, employee data, data about alumni and donors, and applicant data. Please note that you only need to specify identifiable data, so if the data you maintain or use cannot be used to identify a specific individual, you do not need to list it. Please list types of data by activity.

Attach additional sheets if necessary.)

Activity Type of Personal Data

3. Do you receive personally identifiable information directly from individuals?

Yes No

i. If yes, do you obtain their affirmative consent when you do so? Yes No If yes, please provide the consent you use or describe the process.

ii. Do you retain copies or records of the consents you obtain? Yes No

4. Do you receive personally identifiable information from third parties? Yes No

i. If you receive this data from third parties, please list the third parties below and provide the contracts under which you receive this data.

5. Do any of our websites collect personal information from visitors – either automatically or through forms filled out by visitors? Yes No (If ‘No’, proceed to #6 of this section)

i. If websites collect personal information from visitors, do you have a privacy policy posted on our website? Yes No If yes, please provide the privacy policy you use.

ii. Do you notify visitors of the ways in which you use their data? Yes No

If yes, please provide the notification you use or describe the process.

iii. Do you ask visitors to consent before you collect their data? Yes No

If yes, please provide the consent you use or describe the process.

6. Do you collect, store, or use any of the following types of data about individuals from the EU:

• Racial or ethnic origin;

• Political opinions;

• Religious or philosophical beliefs;

• Trade union membership;

• Genetic or biometric data;

• Health data;

• Sexual orientation; and

• Criminal convictions or offenses.

Section 2: Response to Individual Requests

1. How do you respond to requests from individuals about their data?

2. Do you permit them to amend the data you have about them?

Section 3: Data Sharing Do you share any personal information with third parties? For example, do you have vendors to whom you provide personally identifiable information?

Click the 'Submit' button to email this form to Information Security at GRC@uthscsa.edu Questions? Contact us at GRC@uthscsa.edu or 210-567-0707