The General Data Protection Regulation (GDPR) is a set of rules crafted to safeguard personal information of EU residents. This article explains who the GDPR applies to and the steps you can take to get compliant.
The General Data Protection Regulation, commonly known as GDPR, sets strict guidelines for how organizations collect, store, and manage personal data of EU residents.
Effective since May 25, 2018, the GDPR was developed in response to the increasing need to protect individuals' personal data in a rapidly evolving digital world, where data breaches and privacy violations have become all too common.
For companies, this means they need to review their processes and infrastructure, examining what data is collected, where it is collected, and how it is used. For consumers, this regulation is beneficial, as it gives power back to the people since the EU sees privacy as a human right.
There is also a benefit for companies, as this is the only regulation across the entire EU, rather than varying regulations per country.
The GDPR applies to any organization, regardless of its location, if it processes the personal data of individuals in the EU. So, it concerns your company if you handle any data from EU citizens. No matter if you're based in California or the EU, this will apply to you.
This includes businesses, non-profits, government bodies, and any other entities that handle personal data within the EU.
The regulation covers all types of data processing activities, whether the organization is handling data about employees, customers, suppliers, or other individuals.
The GDPR doesn't apply to your organization if you are not processing or monitoring the personal data of individuals in the EU, don't conduct business operations within the EU, and don't offer services or goods to EU residents.
Here's an overview of the key requirements under the GDPR.
To ensure GDPR compliance, data controllers (the entity determining the purpose and means of processing personal data) must establish formal agreements with any third-party entities that process personal data on their behalf. These contracts, known as Data Processing Agreements (DPAs), are crucial for delineating the responsibilities related to data protection and privacy.
According to Article 5, organizations must have a legitimate reason (lawful basis) for processing personal data. This can be based on consent, compliance with a legal obligation, or legitimate interests pursued by the data controller or a third party.
Consent must be freely given, specific, informed, and unambiguous. It requires a clear affirmative action (opt-in), and individuals have the right to withdraw their consent at any time. Pre-ticked boxes and implied consent are not acceptable under GDPR.
Organizations must provide clear information about how they process personal data. This includes detailing the purposes of data processing, data retention periods, and who the data may be shared with. This information is typically provided in a Privacy Policy.
Article 30 stipulates the requirement to maintain records, either in written or electronic form, of processing activities for organizations with 250 or more employees. For entities with fewer than 250 employees, the obligation to keep records still stands if the processing poses a risk to the rights of data subjects and is not an isolated occurrence.
According to Article 32, organizations must establish technical and organizational measures to safeguard personal data. These measures are essential to protect data from unlawful processing and to prevent accidental loss or damage. Key strategies include pseudonymization, encryption, and conducting regular security assessments.
This involves:
Organizations must integrate data protection into their processing activities and business practices.
Organizations are required to inform the relevant Supervisory Authority within 72 hours upon discovering a personal data breach that poses a risk to individuals' rights and freedoms. If the breach is likely to result in a high risk, affected individuals must also be informed without undue delay.
Transferring personal data outside the EU is restricted unless adequate safeguards are in place. This can include binding corporate rules, standard contractual clauses, or other approved mechanisms to ensure data protection compliance.
Here is a step-by-step guide to help organizations ensure they meet GDPR requirements.
Assess whether your organization processes personal data of EU residents and if so, identify the lawful basis for processing this data (e.g., consent, contract necessity, legal obligation, etc.). Here are some examples that would require GDPR compliance for your organization:
In the realm of data protection and privacy, two critical roles stand out: Data Controllers and Data Processors.
Any entity that determines the purposes and means of processing personal data is considered a data controller under the GDPR. Controllers are primarily responsible for ensuring compliance with GDPR principles.
Key Responsibilities:
Examples:
Entities that process data on behalf of controllers are classified as data processors. This can include cloud service providers, data analytics firms, and other third-party service providers. Processors must follow the instructions of the controller and comply with GDPR requirements for data security and processing.
Key Responsibilities:
Examples:
What is considered personal data under the GDPR? It's any information that can be used to identify a user, including emails, photos, bank details, and even IP addresses. Special categories of data, such as health information, racial or ethnic origin, political opinions, and biometric data, are subject to even stricter protections under the GDPR.
Identify what personal data you collect, how it is used, stored, and shared. Where is this personal information stored and who has access to this information?
Data controllers must comply with GDPR principles. Familiarize yourself with key principles of GDPR, including:
This audit should cover all data sources, processing activities, and data sharing arrangements. Maintain detailed records of your data processing activities as required by Article 30 of the GDPR.
Ensure that consent is given voluntarily, with clear and precise information, and without any ambiguity. Review and update consent mechanisms to meet GDPR standards. Where consent is not appropriate, ensure other lawful bases (e.g., legitimate interest, contract necessity) are properly documented and justified.
You need to obtain explicit consent from users in clear, simple language, and provide them with an easy opt-out option. Avoid using complicated language or deceptive practices. It's essential to ensure that users have a straightforward way to stop tracking.
Provide mechanisms for individuals to request access to their personal data and obtain information about how it is processed. Implement processes to correct or delete personal data upon request. Allow individuals to receive their data in a commonly used, machine-readable format and transfer it to another controller.
Implement appropriate security measures such as encryption, pseudonymization, regular security assessments, and access controls to protect personal data. Develop a data breach response plan that includes notifying the supervisory authority within 72 hours and informing affected individuals when necessary.
Secure your website by installing an SSL certificate (HTTPS) to encrypt all data sharing between the site and server. Ensure admin accounts are protected with strong passwords.
Update your Privacy Policy. Provide concise information about how you process personal data, including purposes, retention periods, and rights of individuals. Ensure this information is easily accessible to data subjects.
Under the GDPR, organizations are required to appoint a Data Protection Officer (DPO) if they meet any of the following criteria:
The DPO should oversee data protection strategies and ensure compliance. Also, the DPO should operate independently and report directly to the highest level of management.
Ensure that personal data transferred outside the EU is protected through mechanisms such as standard contractual clauses, binding corporate rules, or adequacy decisions. Regularly review and assess the adequacy of data protection measures in the destination country.
Document all data processing activities, including data protection impact assessments (DPIAs), consent records, and data breach incidents. Continuously monitor and update data protection policies and practices to remain compliant with GDPR.
The General Data Protection Regulation (GDPR) imposes stringent penalties on organizations that fail to comply with its requirements.
The GDPR establishes a tiered approach to fines, which can be substantial depending on the severity of the violation.
Tier 1 Fines: Organizations can face penalties of up to €10 million or 2% of their global annual turnover from the previous financial year, whichever amount is higher. Applied to violations such as:
Tier 2 Fines: Can reach up to €20 million or 4% of the company's global annual revenue from the previous financial year, whichever amount is higher. Applied to more severe violations such as:
Supervisory authorities (like national data protection authorities) have several corrective powers they can use, including warnings, reprimands, orders, and temporary or definitive limitations.
The GDPR is a regulation that specifies how companies should use and protect EU consumer data. The regulation aims to give EU individuals more control over their personal information and imposes significant penalties for non-compliance.