General Data Protection Regulation (GDPR) is a regulation that requires businesses to protect the personal data and privacy of EU citizens for transactions that occur within EU member states. This regulation aims to simplify the regulatory environment for business so both citizens and businesses in the European Union can fully benefit from the digital economy. This regulation agreed upon by the European Parliament and Council in April 2016.
Source: zdnet.com and csoonline.com
Steps to Ensure GDPR Compliance
- Reading the GDPR: Every person in a position to be affected by GDPR should attempt to read and understand this landmark legislation.
- Looking to Other Organizations: Businesses all over the world are affected by GDPR, not just those in the EU.
- Paying Close Attention to Website: Cookies, opt-ins, data storage and more are things that can be easily setup on a website. GDPR’s guidelines for them must be fully complied with.
- Paying Closer Attention to Data: Properly map out how data enters, is stored and/or transferred and deleted. Knowing every route personal information can take is vital to preventing breaches.
Source: digitalguardian.com
GDPR’s Contents
Some of the key requirements of the GDPR include:
- Safely handling the transfer of data across borders.
- Requiring the consent of subjects for data processing.
- Anonymizing collected data to protect privacy.
- Requiring certain companies to appoint a data protection officer to oversee GDPR compliance.
- Providing data breach notifications.
This Regulation has a wide view of what constitutes personal identification information. Under the terms of GDPR, not only do organizations have to ensure that personal data is gathered legally and under strict conditions, but those who collect and manage it are obliged to protect it from misuse and exploitation, as well as to respect the rights of data owners.
Source: zdnet.com and my.socprime.com
What Types of Privacy Data Does the GDPR Protect?
- Basic identity information (such as name, address and ID numbers)
- Web data (such as location, IP address, and cookie data)
- Biometric data
- Health and genetic data
- Sexual orientation
- Racial or ethnic data
- Political opinions
What Does GDPR Mean for Consumers/Citizens?
- One of the major changes GDPR brings is providing consumers with a right to know when their data has been hacked. Whenever personal data is compromised, organizations are required to notify to EU citizens.
- Consumers are also promised easier access to their own personal data in terms of how it is processed.
- This regulation states that all organizations will need to keep these consumer rights in mind.
- GDPR also brings a clarified ‘right to be forgotten’ process, which provides additional rights and freedoms to people who no longer want their personal data processed to have it deleted, providing there’s no grounds for retaining it.
- The GDPR leaves much to interpretation and it is very clear. This gives the GDPR governing body a lot of leeway.
- This regulation ultimately places legal obligations on a processor to maintain records of personal data.
- The GDPR places equal liability on data controllers (the organization that owns the data) and data processors (outside organizations that help manage that data).
- GDPR has strict rules for reporting breaches that everyone in the chain must be able to comply with. At result, all existing contracts with processors (e.g., cloud providers, SaaS vendors, or payroll service providers) and customers need to spell out responsibilities. So, business leaders, IT, and security teams need to understand how the data is stored and processed and agree on a compliant process for reporting.
You can read more information about General Data Protection Regulation here.
———————————
Sources:
