General Data Protection Regulation

The General Data Protection Regulation (GDPR) is a new European privacy law, systematizing data protection laws throughout the European Union by applying unified data protection law throughout each EU Member State.

The GDPR was approved by the European Union Parliament in April 2016. It will come into effect after a two-year transition period – that is May 25th, 2018.

Any information related to a natural person or “data subject”, which can be used to identify that person or subject either directly or indirectly. This information includes names, photographs, email addresses, bank details, passwords, correspondence, posts/comments on social media platforms, medical information, and computer IP addresses.

The GDPR applies to all organizations established in the EU, and to those (no matter where their geographical location) that process the personal data of EU citizens. It covers organizations offering goods or services to data subjects in the EU, and monitoring taking place on EU territory. 

The GDPR will completely replace the EU Data Protection Directive, also known as Directive 95/46/EC. From May 25, 2018 the existing DPD, along with all the laws relating to it, will no longer apply.

One of the key aspects of the GDPR is that it creates consistency across EU Member States on how personal data can be processed, used, and exchanged securely. Organizations will need to demonstrate the security of the data they are processing and their compliance with the GDPR on a continual basis, by implementing and regularly reviewing robust technical and organizational measures, as well as compliance policies.

According to the GDPR regulations, the severity of the information breach will determine the level of the financial penalty imposed. You may be fined up to EUR 20 billion or 4% of your company’s worldwide revenue, whichever amount is greater. Less serious violations (e.g. improper record-keeping, failing to notify about leaks) will attract fines of a maximum of 2% of the company’s annual global turnover, or EUR 10 million.

GDPR Article 5 states that personal data must be processed lawfully, fairly and in a transparent manner, collected only for specified, explicit and legitimate purposes, adequate, relevant and limited to what is necessary, accurate and kept up to date, held only for the time absolutely necessary and no longer, and processed in a manner that ensures appropriate security of the personal data. 

You should start preparing your company, clients and partners for the GDPR as soon as possible. If you already have high-level data security and privacy processes in place, this should not be a problem. However, if you just started implementing GDPR compliance you need to begin by auditing your security and data protection practices to ensure a smooth transition later.

If your enterprise is large, it is advisable to appoint a Data Protection Officer (DPO) to manage data security and other issues related to personal data processing.

What is more, you may need to file a Data Protection Impact Assessment with the supervisory authority, which may inspect and approve your data processing activities.

The GDPR points out eight fundamental rights of individuals. These are:

1. The right to be informed – individuals have the right to know how organizations are using their personal data.
2. The right of access – individuals have the right to know exactly what information about them is held and how it is processed.
3. The right of rectification – individuals have the right to rectify their personal data if it incomplete or inaccurate.
4. The right to erasure – individuals have the right to have their personal data deleted without specifying the reason for it. 
5. The right to restrict processing – individuals have the right to block or suppress processing of their personal data.
6. The right to data portability - individuals have the right to retain and reuse their personal details for their own purposes. 
7. The right to object - individuals have the right to object to their personal data being used (e.g. for direct marketing or scientific research).
8. Rights of automated decision-making and profiling - individuals have the right to choose not to be the subject of a decision where the consequence has a legal bearing on them, or is based on automated processing.

The GDPR’s function is to become a universal set of rules of data protection and rights across the EU. The GDPR introduces less complicated legal processes (dealing with one international law, instead of multiple local regulations) and consistency in regulations applying to all companies, no matter where they are located. 

A data controller determines the purposes, conditions and means of the processing of personal data. A processor is an entity which processes personal data on behalf of the controller.