Merck is a global science and technology company focused on Healthcare, Life Science and Performance Materials. Based in Germany, it is part of a highly regulated industry, so it needed to comply with data protection legislation: Law 29733 in Peru and GDPR.
Merck Peru
Project: Law 29733 & GDPR Implementation
Our mission was to create a Personal Data Protection Management System that includes registration of data processing activities to the Authority, to obtain consents and inform data subjects, and to implement Technical and Organizational Security Measures (TOMs) that allowed the organization to successfully comply with this important aspect of the digital economy.
Our mission was to create a Personal Data Protection Management System that includes registration of data processing activities to the Authority, to obtain consents and inform data subjects, and to implement Technical and Organizational Security Measures (TOMs) that allowed the organization to successfully comply with this important aspect of the digital economy.
Before
- There was only one corporate policy that was declarative for Peru
After
- The data banks necessary for the interaction of the company with its workers, suppliers, healthcare professionals, patients, clients, among others, with whom it maintains different types of relationships were declared.
- Cross-border flows were declared when personal data is shared with third parties abroad.
- The necessary consents are obtained for the processing of personal data.
- Changes are communicated through Privacy Notices.
- Training programs on the subject were implemented.
- There is a continuous implementation process of Technical and Organizational Security Measures (TOMs) in accordance with changes in the organization.
- Support is provided to the Local Data Privacy Officer role.