What is GDPR?

Overview

The GDPR is a regulation in EU law on data protection and privacy for all individuals within the European Union (EU). It also addresses the export of personal data outside the EU. The GDPR aims primarily to give control back to citizens and residents over their personal data and to simplify the regulatory environment for international business by unifying the regulation within the EU.

Companies must be able to demonstrate that data is being processed in a transparent way, with the appropriate security measures in place. This includes having the appropriate technical and organizational measures in place to protect data from being accidentally or unlawfully destroyed, lost, altered, disclosed or accessed. Additionally, companies must show that personal data is only collected and used for specified, explicit and legitimate purposes.

Organizations must also appoint a Data Protection Officer (DPO) if they fall under certain criteria, such as performing large scale systematic monitoring of individuals or processing data on a large scale. The purpose of a DPO is to ensure that the company is compliant with GDPR.

By understanding the principles and requirements of GDPR, organizations can protect their customers’ data, build trust and be better prepared to handle any data-related issues. Ultimately, GDPR is designed to give citizens and residents of the EU more control over their personal data and how it is used.

Stricter Privacy Laws

The General Data Protection Regulation became effective May 25, 2018 in order to standardize data privacy laws throughout the European Union and affording individuals stronger rights and protections.

It could be said that GDPR is the world’s strongest set of data protection rules. They not only empower individuals with control over their personal information, but they also place restrictions on what organizations can do with that data. GDPR is comprised of 99 articles.

Many have lauded GDPR as a step forward in how personal data should be handled, noting its similarities to the California Consumer Privacy Act.

Who is affected by the GDPR?

The GDPR is designed to protect personal data. This term refers to information that can be used to identify a living person, directly or indirectly. Personal data refers to information that can identify an individual, which can be something obvious like a person’s name or location. But it can also be something less apparent, such as IP addresses and cookie identifiers.

GDPR not only protects standard categories of personal data, but also special categories of sensitive personal data. This includes information about racial or ethnic origin, political opinions, religious beliefs, membership in trade unions, genetic and biometric data, health information and data related to a person’s sex life or orientation.

The key determining factor of whether something counts as personal data is if it could lead to the identification of an individual. While seemingly anonymous, pseudonymised data can still count as personal data under GDPR.

Integrity and confidentiality (security)

Personal data is vulnerable to unauthorized or unlawful processing, as well as accidental loss, destruction, or damage. In other words, information security protections must be put in place to prevent information from being accessed by hackers or accidentally leaked during a data breach.

While GDPR doesn’t give a step-by-step guide on how to ensure data security, it does state that the level of protection must be relative to the sensitivity of the information being protected. For example, a bank will have to take more precautions than your local dentist. To keep information safe, access controls should be put in place, websites should be encrypted, and pseudonymisation is a good idea.

Accountability

GDPR’s only new principle is accountability, which was created to show that companies are adhering to the other principles set forth by GDPR. Accountability, at its core, means documenting how personal data is handled and what steps are taken to ensure that only authorized individuals can access certain information. Accountability might also involve training staff in data protection measures and regularly evaluating data handling processes.

What are my GDPR rights?

GDPR’s main focus may be on data controllers and processors, but the legislation ultimately protects individuals and their rights. Article 8 of GDPR details eight specific rights individuals are entitled to, including easy access to the data companies hold about them as well as the right for that data to be deleted under certain circumstances.

The full General Data Protection Regulation (GDPR) rights for individuals include: the right to be informed, the right of access, the right to rectification, the right to erasure, the restrict processing right ,the data portability right ,the object right and also rights around automated decision making and profiling.

Access to your data

The General Data Protection Regulation (GDPR) allows individuals to inquire about the data an organization has gathered on them for free. This is known as a Subject Access Request (SAR). No one else can request information on your behalf, but someone else, such as a lawyer, can make the request for you.

SARs can be requested either in writing or verbally – meaning an organization has to determine whether what has been asked for is classed as personal data under GDPR. Although SARs can be sent through social media, most people will send them via email.

Automated processing, erasure and data portability

The GDPR not only strengthens a person’s rights around automated data processing, but also gives them the right to opt out of any decisions that could produce a significant effect on their life.

The regulation empowers individuals to have their data erased in some cases, such as when it’s no longer needed for the reason it was collected, if they withdraw consent, there’s no legitimate interest present, or if processing happened unlawfully.

GDPR breaches and fines

If an organization doesn’t process an individual’s data in the correct way, it can be fined. If it requires and doesn’t have a data protection officer, it can be fined. If there’s a security breach, it can also be fined.

Smaller GDPR offenses come with a potential fine of €10 million or two percent of your company’s global earnings (whichever is worse). The more serious GDPR breaches have even heftier consequences: fines going up to €20 million or four percent of your firm’s global revenue (again, whichever number is greater).