GENERAL DATA PROTECTION REGULATION

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, known as the GDPR, has applied in all EU Member States since 25 May 2018. It gives citizens a number of rights, such as the right to information, the right of access to personal data, the right to rectification and erasure (the right to be forgotten), the right to restriction of processing, the right to data portability and the right to object. Under the GDPR, “personal data” means any information relating to an identified or identifiable natural person (data subject), directly or indirectly, by reference to a name, surname, an identification number, etc.

ASPAAS collects the following personal data needed to provide services to citizens/petitioners and support activities specific to public administration:

Depending on the nature of the activity, we collect and process, under Law No 162/2017 and internal rules and procedures, in order to perform our legal tasks, the following categories of personal data of natural and legal persons outside the institution:

– Name and surname – Personal/professional address – Personal identification number (CNP) – Tax identification number (CIF) – CAEN code – ID card series and number – Email address – Mobile/landline/fax number – Data on education and profession – Data on offences/convictions – Criminal record – Tax data – Data on the composition and activities of audit firms in the exercise of the financial audit profession – Data on the activities of statutory auditors in the exercise of the financial audit profession – Data on the workplace and position of registered auditors needed for suspension from the profession (certificate from the employer, pension slip, etc.) – Data on other confidential matters needed for suspension from the profession (child’s birth certificate, disability decision, etc.) – Information on personal data and confidential information used by specialised staff in carrying out inspections and investigations

In the context of collaborations for the supply of goods and services, we collect personal data of legal or delegated representatives, their position, mobile phone, email address, etc.;

To ensure guarding and security measures (for employees, visitors, guests, etc.), video surveillance is carried out in ASPAAS premises (main entrance), collecting images of the persons who access this area. The data are stored for 20 days.

Further information is available from:

the National Supervisory Authority for Personal Data Processing

The institution has also published guidance on the application of the Regulation, available at:

Regulation (EU) 2016/679