General Data Protection Regulation (GDPR)

The EU General Data Protection Regulation (GDPR) replaced the Data Protection Directive 95/46/EC and was designed to harmonise data privacy laws across Europe, to protect and empower all EU citizens' data privacy and to reshape the way organisations across the region approach data privacy. The enforcement date for all EU countries was 25th of May 2018. Norway, not being a member of the EU, transposed the EU regulations into its national law in accordance with the provisions of the GDPR.

Who does the GDPR affect?

The GDPR not only applies to organisations located within the EU but it will also apply to organisations located outside of the EU if they offer goods or services to, or monitor the behaviour of, EU data subjects. It applies to all companies processing and holding the personal data of data subjects residing in the European Union, regardless of the company’s location.

Visma Data protection program

Visma naturally sets out to ensure that all of our software services, to the very best of our efforts, are compliant with the GDPR. Therefore, we have a comprehensive program specifically with the GDPR in mind, comprised of the following main components:
  • Mandatory training for our employees
  • Data protection built into development and production
  • Dedicated data protection manager
  • A data processing agreement

Read more about our program in Visma Trust Centre (https://www.visma.com/trust-centre/privacy).

What constitutes personal data?

Any information related to a natural person or ‘Data Subject’, that can be used to directly or indirectly identify the person. It can be anything from a name, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer IP address.

Visma as a provider of cloud and on premises software focuses heavily on this area to ensure our customers will be able to comply with the regulations. This document provides guidelines for Business NXT in order to set up the system in a way to support the requirements according to GDPR. However, Business NXT is a flexible and highly customisable ERP system. Each company may use the system differently and may store different types of data in the various Visma solutions.

Following this document alone can't be used as acceptance criteria for GDPR compliance. Each company needs to verify their own practices when using Business NXT or other systems and verify that they have a process in place which is in line with the regulations.

Business NXT is often connected with Visma.net cloud services like Visma.net AutoInvoice, Visma AutoPay or Visma.net Approval. This document covers the guidelines for connecting to these services in a secure way.

More information about security and privacy is available in Visma Trust Centre (https://www.visma.com/trust-centre).