A Guide to GDPR-compliant Mobile Archiving

Contact Us

Contact Us

[contact-form-7 404 "Not Found"]
by

The General Data Protection Regulation (GDPR) is one of the most important and strictest privacy and security regulations that aim to protect sensitive personal information. Established by the European Parliament, the Council of the European Union, and the European Commission, it came into effect on May 25, 2018, and replaced the 1995 EU Data Protection Directive. All organizations operating within the EU and outside of the EU that offer goods or services to individuals on mobile within the EU are subject to the GDPR. If an organization falls within these two categories and processes personal mobile data, it must abide by the rules of GDPR.

As one of the strictest mobile protection regulations, penalties for non-compliance can be significant. A first-tier breach of GDPR occurs when an organization fails to appoint a representative, and the fines can be up to €10,000,000 or up to 2% of the organization’s annual revenue, whichever is higher. The penalty for a breach of the second tier can amount 4% of a company’s annual global turnover or €20 million (whichever is greater) in the preceding financial year, whichever is higher. In addition, civil liabilities also apply.

What is GDPR-Compliant Mobile Data Archiving?

Archiving mobile business-related communications is mandatory to meet the requirements of various communication compliance regulations, and personal mobile data can be involved. To be GDPR compliant while performing tasks like text message monitoring, call monitoring, etc., firms must protect individuals’ following personal mobile data rights specified by GDPR.

  • Right to be informed about how mobile data are being collected and used
  • Right to access copies of the mobile data
  • Right to request to update inaccurate or outdated personal mobile data
  • Right to delete mobile data
  • Right to request personal mobile data to be transferred to another controller or provided to them.
  • Right to restrict processing
  • Right to withdraw consent
  • Right to oppose processing mobile data
  • Right to oppose automated processing
  • Right to withdraw consent.

In addition, firms must strictly follow the GDPR principles related to data processing. Regulated firms must appoint a Data Protection Officer (DPO) to ensure that their mobile protection practices align with the GDPR.

Checklist for GDPR-Compliant Mobile Data Archiving.

  1. Conduct an audit of the mobile personal mobile data you are archiving

According to Recital 23, understand the processing activities associated with the GDPR. Also, the GDPR principles related to data processing state that personal mobile data must be processed in a lawful, fair, and transparent manner protecting the privacy rights of EU citizens.

Therefore, organizations must audit what types of mobile personal mobile data they capture, archive, and process, whether those mobile contain any personal information, and whether they are related to EU citizens. This shows you have taken the initial steps to comply with GDPR and ensure fair treatment of personal mobile data.

  1. Obtain consent to process personal mobile data

Once you’ve identified and formalized what and how the personal mobile data may be captured, formulate the legal background to prove why capturing and retaining this mobile is necessary. Inform your legal team and get further clarification to ensure you’ve taken sufficient steps to comply with the regulation.

Inform the employees and clients about how these mobile are collected and used. Firms must obtain clear consent from individuals to use their mobile and be transparent about how they collect and process them.

  1. Demonstrate that you practice the core principles concerning mobile privacy and protection

Another GDPR mobile processing principle is that mobile must be processed in a manner that ensures appropriate security of the personal mobile data, including protection against unauthorized or unlawful processing and accidental loss, destruction, or damage, using appropriate technical or organizational measures (‘integrity and confidentiality).

To avoid mobile leaks, your archival solution must have the required security measures, such as end-to-end encryption, access control, and built-in mobile protection.  Always follow the mobile protection rules by design and default.  Restrict the mobile access only to required people through permissions and groups.

  1. Keep the mobile accurate and up-to-date

Under the GDPR law, people whose personal mobile data are being processed have the right to request to update inaccurate or outdated personal mobile data. GDPR requires firms to take every reasonable step to ensure that inaccurate personal mobile data regarding the purposes for which they are processed are erased or rectified without delay (‘accuracy’).  Therefore, your mobile archiving system must maintain the latest and updated mobile omitting outdated mobile in storage.

  1. Ensure the mobile are retained for the required retention period

GDPR allows storing mobile in archives for longer periods if the mobile is being processed for archiving purposes in the public interest and scientific purposes. To meet this requirement, organizations can create duration-based retention policies according to applicable regulations and automatically remove the mobile after the retention period is completed.

  1. Notify in case of a mobile breach to the authorities without undue delay

Articles 33 and 34 of GDPR require organizations to notify the authorities  “not later than 72 hours after having become aware of it, notify the personal mobile data breach to the supervisory authority”. The supervisory authorities include local government officials, FTC, or the EU.

To meet this requirement, your archive system must have monitoring procedures. Such monitoring systems must monitor the changes to the mobile and integrate with alerting and notification systems to notify of any abnormal mobile change behaviors to the required people promptly.

  1. Allow personal mobile data to be removed upon request by the mobile subject

As per GDPR principles, individuals have the right to request to delete their personal mobile data. To accommodate this requirement, the archival systems must separate the personal mobile data from all the other data they archive and allow querying for personal mobile data. When a request comes for mobile deletion, remove only the personal mobile data keeping the other important mobile intact.

How TeleMessage Helps GDPR-Compliant Mobile Data Archiving

TeleMessage enterprise and mobile archivers are secure enterprise messaging solutions that enable employees to communicate collaboratively while meeting the required GDPR requirements. For example, the TeleMessage Enterprise Number Archiver is equipped with necessary security mechanisms such as end-to-end encryption and message self-destructs.

Also, mobile is captured and stored in secure and unified archives. This unified archival enables firms to easily find out what personal mobile data are involved in the communications they capture and separate them from the business logic.

The TeleMessage Privacy Shield Frameworks ensure full privacy compliance for all our archiving customers, And while our WhatsApp servers are in the U.S., they are still GDPR compliant.

Finally, note that TeleMessage can split the recorded mobile number and Mobile IM from the personal non recorded one.

About TeleMessage

TeleMessage captures and retains mobile content, including mobile SMS messages, voice calls, WhatsApp, and WeChat conversations from corporate or BYOD mobile phones to ensure compliance with various mobile protection regulations. The messages are securely and reliably retained within TeleMessage servers or forwarded to your choice of archiving mobile storage vendor.

Our mobile archiving products securely record content from mobile carriers and mobile devices for various ownership models (BYOD, CYOD, and employer-issued). With our multiple archiving solutions, you can always find the right tools or blend for your requirements:

TeleMessage offers cross-carrier and international mobile text & call archiving for corporate and BYOD phones. Visit our website at www.telemessage.com to learn more about our mobile archiving products.

Skip to content