The new General Data Protection Regulation ("GDPR") has sought, among other aspects, to strengthen and harmonize throughout the European Union a set of rules for the defense of the rights, freedoms and guarantees of the citizens with respect to the processing of their personal data and has also established multiple principles and obligations for the entities that collect and process such personal data.

Despite the continuous EDP Group's commitment to ensure privacy and to protect the personal data of its customers, employees, suppliers or other third parties, with the beginning of the applicability of the GDPR, the procedures to evaluate and anticipate possible risks related to the processing operations and the respective mitigation measures have been adjusted, complemented with specific training and awareness actions and with the implementation of dedicated channels and teams to manage requests for the exercise of rights and to handle complaints.   

Learn more about how EDP Group protects personal data of its multiple stakeholders.

In the relationship with these stakeholders (customers, employees, suppliers, etc.), the data subjects, EDP provides information on the data processing carried out through specific privacy policies or data protection disclaimers. According to the legal requirements, in these documents, the EDP Group entities include, among other aspects, the following information:

• The contact details of the entity responsible for the data processing;
• The contact details of the respective Data Protection Officer (DPO), through which the data subjects may exercise their rights in relation to the protection of personal data, request information or clarification about their data and lodge complaints.
• The purposes for which they process the personal data and the legal basis for such processing. If data is used for secondary purposes, all the data subjects are also informed about these secondary purposes.
• Whether the personal data is shared with other entities.
• The retention periods for the personal data. 
• The technical and organisational measures adopted.

Examples

• EDP Comercial, a company operating in the free market, in Portugal, shares information about the company's data protection policy, regarding the use of information collected, customer rights and security procedures. See here.
• The EDP Group also undertakes to manage the information in order to ensure the protection of the integrity and confidentiality of the supplier's affairs. See here.