Everything that depends on the country of a legal entity comes from a country model, never from MyZapp: the supervisory authority and its online services, deadlines (breaches, rights requests), the age of minors' consent, adequacy decisions, the authority's impact assessment lists and obligations of national law. The screen is under Data protection › Country models.
Built-in models
| Model | Country | Content |
|---|---|---|
eu-gdpr |
European Union and EEA (baseline) | 72 hours to notify a breach, one month (extendable by two) to answer a request, 16 for minors' consent, countries recognized as adequate, EDPB DPIA criteria |
fr-cnil |
France | CNIL and its online services, 15, CNIL lists of processing requiring a DPIA and of processing exempt from one, post-mortem directives, cookies |
es-aepd |
Spain | AEPD, 14, AEPD DPIA criteria (art. 35.4) and exemption list (art. 35.5), digital rights, mandatory DPO (art. 34 LOPDGDD), data blocking, whistleblowing channel |
co-sic |
Colombia | SIC, incidents reported within 15 business days, queries within 10 business days (+5) and claims within 15 (+8), processing policy, prior authorization, national database register (RNBD) |
A national model refines the Union baseline: its values apply first, the baseline fills in the rest.
Validation status
Each model shows its status: To review against the texts, Reviewed against the texts, then Validated by a lawyer. Until a model is validated, check its values before relying on them.
Sources
Each built-in model cites the sources consulted for its data, with their date. A source marked Not verified is secondary or could not be confirmed on the official text: have your lawyer check the data.
The model of each entity
At the top of the screen, each legal entity shows the model that applies to its country: the country's own, otherwise the Union baseline for a Union or EEA country.
The model already serves:
- to suggest the authority of a new data breach when you leave it empty;
- to flag, on a processor, a transfer based on adequacy to a country no model recognizes as adequate;
- to give the impact assessment the authority's list (in France, the CNIL lists; in Spain, the AEPD criteria and exemptions);
- to check the age of minors' consent: when a form knows the person's date of birth and country, their consent is recorded, below the model's age (15 in France, 14 in Spain), only with the authorization of the holder of parental responsibility, traced in the proof. Without a date of birth, or if the model sets no age (Colombia), nothing is checked; a withdrawal is never refused.
Importing a model
The data protection officer can import a model (JSON document): it replaces the built-in model with the same code. Use it for another country, or for a version validated by your lawyer.