GDPR Compliance: The Most In-Depth Guide

The EU General Data Protection Regulation (GDPR) is a regulation issued by the European Commission, the European Parliament and the Council of Ministers of the European Union with the purpose of strengthening and unifying data protection for individuals within the European Union. It is the most important change in data privacy regulation in 20 years. It took four years of preparation and debate until it was finally approved by the EU Parliament on 14 April 2016.

The GDPR makes a big statement about individuals’ private data and their right to request data controllers and processors to delete, correct, and forward their data. In consequence, GDPR brings significant changes to its predecessor, the Data Protection Directive 95/46/EC that will require operational changes in organizations and impose major fines in case of failure to protect EU data subjects.

Extended jurisdiction

The GDPR clearly defines territorial applicability, stating that it applies to all organizations collecting and processing personal data of individuals residing in the EU, regardless of the company location, so it doesn’t matter if the processing takes place in the European Union or not. For example, a company with the HQ in the USA, offering goods or services to EU data subjects, falls under the GDPR's jurisdiction.

Consent

No more evasive consent notices. All organizations will be obliged to obtain individuals’ consent to store and use their data and they must explain how it is used. At any time after the regulation comes into effect, data collectors must be able to prove that consent has been obtained. For individuals, it will be easier to withdraw their approval.

Mandatory breach notification

Companies are obligated to notify the supervisory authority within 72 hours of discovering the breach unless the breach is unlikely to “result in a risk to the rights and freedom of individuals.” The notification has to include specific information about the nature of the data breach, the number, and type of breached records, the name of the Data Protection Officer, the measures taken to mitigate the risks, and other details.

Data Protection Officers

Both data controllers and data processors are required to appoint a Data Protection Officer. Who can take the role of the DPO and what he/she is responsible for are detailed in Articles 37 to 39 of the GDPR. In short, the DPO can be a member of the organization’s staff or can be contracted for services.

NOT all companies are obligated to have a DPO, but only those “controllers and processors whose core activities consist of processing operations which require regular and systematic monitoring of data subjects on a large scale or of special categories of data or data relating to criminal convictions and offenses". The DPO’s main responsibilities are to ensure the application of the GDPR, to keep a register of the processing operations involving private data, to provide advice and inform data collectors and processors of their obligations as listed in the GDPR.

To be able to apply the enhanced, stricter rules, organizations should perform an audit of their current data security solutions and processes implementation and build upon it. The audit should reveal what data is collected from individuals, if there are proper consent procedures, where private details are stored, who has access to them, how is the integrity of private data ensured, etc. Based on the discovered information, a solid plan for upgrading to the new regulation can be outlined and shared with all involved parties.

Let’s see how the game plan would look like in order to maximize your chances of getting to the finish line without spending too many resources.

Disciplined execution

The strategy is worth nothing without a disciplined execution. Knowing what data security and management solutions have to be selected and implemented to ensure compliance and security are not as easy as it might seem. There are numerous factors that weigh in and the human factor is the most complex. A simple example would be the Data Protection Officer that has to be appointed. Companies have a tough decision to make, considering the level of responsibility assigned to a DPO. The officer has to make sure that data protection compliance is met, so his/her role is crucial and difficult, having to deal with employees on one side and department managers on the other.

Also difficult to execute is the article referring to the cross-borders transfers which extend farther than the physical borders where the headquarter or branches of a company are. A company operating in Germany can have customers in France, USA or any other country. This comes with a big responsibility concerning individuals’ data security. The GDPR will apply to the processing of personal data of individuals residing in the EU, even if the data controller or processor is not located in the EU. So, if your business is not in the European Union, you can still be subject to the regulation.

The General Data Protection Regulation can cause serious headaches until full compliance is achieved, but after that milestone, organizations will be able to see how the benefits outweigh the efforts. Entering new markets in Europe will be easier for businesses because the data protection regulation will be the same as in their home country. The European Commission exemplifies in a press release how companies can cut costs thanks to the reform.

The GDPR is causing a lot of noise among businesses, especially European ones. Many are not yet sure in what position they are, if they are a data controller or data processor. Many companies are delaying the start of compliance procedures because they feel overwhelmed by the necessary changes and others are simply not aware of the implications.

Regardless of what position you find yourself in, on 25 May 2018 everything has to be in place and starting with that moment, you have to be able to prove at any time you are compliant and that you securely conduct your activity without endangering the privacy of your employees, customers, partners, and other stakeholders.