Introduction
The General Data Protection Regulation, in short GDPR, is a regulation in EU law that is intended to strengthen and unify data protection and privacy not only in the European Union (EU) but the entire European Economic Area (EEA). It was issued by the European Commission and includes a set of standardized protection laws that are designed to protect the Personally Identifiable Information (PII) of all EU citizens. However, the GDPR also regulates the transfer of personal data outside the areas of the EU and EEA.
The GDPR was first adopted in 2016 and came into full effect two years later. Since the GDPR is a set of regulations and not a directive, it became immediately enforceable as law in all member states of the EU in May 2018. As a new regulatory framework aimed to protect personal data and to provide a regulatory environment for businesses, it had implications for all organizations, enterprises, and individuals across the EEA. Thus, it set clear rules for companies on how to process and store the personal data of individuals.
GDPR and what it means for your company
As the protection of personal data is the main focus of the GDPR, it is now easier for EU citizens to understand what companies are doing with their information. Consequently, online customers have increased awareness when it comes to their rights. This in turn means that businesses need to adapt their operations to the new regulations in order to create the required transparency. If your company processes PII and operates within the EU, you are obliged to adhere to the GDPR. However, this is easier said than done.
On the one hand, the standardization that the GDPR has introduced to the digital business world comes with numerous benefits. On the other hand, implementing the regulations can be a real challenge for companies that aren’t well-prepared or have a lack knowledge. Plus, the complexity and quality of their data can make it difficult to transition into a new modus operandi. As of now, there’s still a big number of enterprises that don’t fully meet the GDPR. This comes at a high price as non-complying business owners face heavy penalties.
In order to become fully compliant with the GDPR, businesses need to work through a set of complicated steps. This might include an overhaul of their privacy policy, cleaning up newsletter mailing lists, or adjusting how cookies and plugins are being used. It is especially in the beginning when some degree of legal uncertainty slows down the process or causes confusion. Since expert help is required more often than not, companies need to account for additional expenses and increase their data security budget.
Major changes under GDPR
The GDPR has brought a lot of changes to the digital business landscape, many of them involving transparency and consent when it comes to collecting personal data. Here’s a non-exhaustive list of the key changes every business doing trade with EU citizens should be aware of.
Art. 3 GDPR: Increased territorial scope
This new regulation addresses the processing of personal data done by companies operating in the EU, regardless of whether the processing takes place in the EU or not. This is how the legislator wants to ensure comprehensive protection of the data subjects’ rights and create a level playing field.
Art. 7 GDPR: Conditions for consent
Companies are not allowed to hide behind complicated terms and conditions anymore when processing personal data. Thus, they’re required to get the data subjects’ consent while presenting their request in a clear manner using accessible and plain language.
Art. 33 GDPR: Notification of a personal data breach to the supervisory authority
Despite the strictest data security measures, data breaches can occur. If the rights and freedoms of natural persons are at risk, a company has to act within 72 hours after having become aware of the data breach and notify the supervisory authority.
Art. 15 GDPR: Right to access by the data subject
The data subject is entitled to receive confirmation from the company or controller whenever personal data concerning him or her are being processed. This includes the nature of the data, the purpose of the processing, how long the data will be stored, who will obtain access to it, and more.
Art. 17 GDPR: Right to erasure “right to be forgotten”
The data subject has the right to have his or her personal data erased without undue delay. Among other circumstances, this applies when the data is no longer necessary in relation to the purpose of collection or processing or when the data has been processed in an unlawful way.
Art. 20 GDPR: Right to data portability
Whenever the data subject is sharing personal data, he or she has the right to receive this data in a well-structured and machine-readable format. The company or controller also has to make sure that the data can be transmitted to another controller if requested by the subject.
Art. 25 GDPR: Data protection by design and by default
When processing personal data, the company or controller needs to implement data-protection principles such as pseudonymization, data minimization, and other appropriate measures that are within technical and organizational reasons. This is to ensure that personal data is properly safeguarded.
Art. 37 GDPR: Designation of the data protection officer
Whenever the data processing is carried out by a public authority or if an organization is dealing with a large scale of special categories of data, a Data Protection Officer (DPO) needs to be appointed. It is the DPO's role to monitor data and make sure that data protection measures are on par with state-of-the-art technology.
GDPR Penalties
The projected penalties for noncompliance are steep. Below is the penalty breakdown within the regulation:
Fine: 10,000,000 Euros or 2% of your company's Global Turnover, for offenses related to:
- Child consent;
- Data processing, security, storage, breach, breach notification;
- Transfers related to appropriate safeguards and binding corporate rules; and
- Transparency of information and communication.
Fine: 20,000,000 Euros or 4% of Global Turnover, for offenses related to:
To put it simply, GDPR should be taken very seriously, and everyone in your company should be alert to the steps they can take to ensure compliance. Here's how Enterprise Architect can help.
/EN/Reports/Thumbnail-Obsolescence-Gartner.png?width=260&height=171&name=Thumbnail-Obsolescence-Gartner.png)
