Today GDPR compliance is an essential requirement for companies and vendors engaged in developing and producing business management software. However, the intricate complexity of the regulation—together with ever-growing security and transparency demands—calls for clear, practical tools to ensure its rigorous application.
To meet this need, the Italian Data Protection Authority (the Garante) has recently officially approved and published the "Code of Conduct for the processing of personal data carried out by companies developing and producing business management software", a document that finally makes the application of the GDPR easier, more consistent and more uniform for companies in the IT sector.
The Garante's Code of Conduct is a decisive self-regulation tool that sets common rules and standards for all companies that produce, develop or market business management software intended to process personal data. By adhering to the code, software companies formally demonstrate their commitment to privacy protection and can guarantee their customers – from SMEs to large organizations – products that are fully GDPR-compliant.
The main aspects provided for by the Garante's Code include:
- The "privacy by design and by default" principles contained in the GDPR, under which all business management software must be designed from the outset with data protection built in, providing security measures suited to safeguarding the confidentiality and integrity of the information processed.
- The Code prescribes detailed requirements and methodologies for data protection, setting minimum standards for cybersecurity, backup procedures, access management, encryption and logging of data access
- Producers of business management software must provide their customers with all the information needed to verify compliance with GDPR requirements, including clear documentation on how the software processes personal data
- Particular attention is paid to defining the roles of controller and processor of personal data, specifying mutual duties and responsibilities within the contractual relationship between producers and users of business management software
Adhering to this Code is certainly an added value for software companies operating on the Italian and European market and brings them multiple benefits:
- Greater competitiveness, because adherence is attested by a Monitoring Body accredited by the Garante and published in an official register, making the compliance of products and processes with the GDPR immediately demonstrable; Possible mitigation of administrative fines, since Art. 83(2)(j) GDPR provides that adherence to an approved code of conduct is to be considered a mitigating circumstance by the supervisory authority; Greater reliability and credibility in the eyes of customers and business partners, a key factor in standing out from the competition;
Adherence to the Garante's Code of Conduct is, in general, voluntary. However, it is a practice strongly recommended by the Garante. To adhere, in fact, it is enough to formally declare a commitment to adopting the rules and procedures contained in the code and to undergo periodic independent audits carried out by accredited bodies to verify compliance.
In addition to being a practice expressly recommended by the Garante, adherence, verified by an accredited monitoring body, gives member companies an important competitive advantage, showing end customers genuine attention to the security and protection of personal data.
In any case, it should be remembered that adherence to a code of conduct does not in itself guarantee compliance with the GDPR, nor does it give the controller or processor immunity from the penalties or liability provided for by the GDPR.
In conclusion, the Code of Conduct is a great opportunity for companies that develop and produce business management software. It brings regulatory clarity, improves customer trust, reduces liability risks and establishes a responsible stance towards the protection and security of personal information.
In the current context, marked by stringent regulations and growing attention to issues of security and personal data processing, adhering to the Garante's Code of Conduct is a strategic and forward-looking decision, set to increase the value of the software products offered on the market.
For this very reason, one of the services Argo offers to companies that produce business management software is compliance support for adhering to the Garante's Code of Conduct.
Would you like more information on how we can help your company with the process of adhering to the Code of Conduct? Write to us using the contact form or send an email to info@argobs.com.