GDPR, which will come directly into effect in all EU member states on May 25, 2018 and obliges companies to safeguard the privacy of data subjects.
As the new regulation will affect all organizations that handle personal data, we need to ask ourselves why this regulation is so important and how companies can get properly prepared for it. It will be key to prepare sufficiently since GDPR introduces high sanctions for non-compliance, including revenue based fines of up to 4% of annual worldwide turnover or €20 million in cash, whichever is higher.
Which substantial changes are coming our way?
Keep a detailed record of all processing activities
Companies will have to keep records of personal data processing (under article 30, GDPR). Such records state what types of data are recorded, with whom this is shared and which safety precautions have been taken to protect this data.
Accountability and transparency are key
GDPR requires companies to demonstrate more transparency and to respect the increased rights of data subjects such as the right to be forgotten, the right to data portability, the right to rectify, the right to object and the right to restriction of processing.
Consequently, policies, contracts and supply chains will need to be reviewed and realigned as much as possible, in order to be in accordance with the GDPR before it comes into effect.
Data Protection Officers
One of the most significant changes that is introduced by GDPR is the requirement to notify data breaches to supervisory authorities and the affected individual no later than 72 hours after discovering it.
Compliance must be demonstrated, let's embrace it!
As with so much of GDPR, being able to demonstrate that the appropriate measures were undertaken will be key. That’s why GDPR compliance can be considered an ongoing process that will require the support of a multidisciplinary team (in-house or via consultancy).
Author: Florence Leterme. You can follow Florence on Twitter or connect with her on LinkedIn.