GDPR stands for European Union General Data Protection Regulation. It comprises a set of rules for data protection for all European citizens, replaces the Data Protection Directive 95/46/EC and was designed to harmonize data privacy laws across Europe, to protect and empower all EU citizens’ data privacy and to reshape the way organizations across the region approach data privacy. The main reason for setting new rules for data protection is rapid growth of the amount of data and completely new way of accessing and processing the data.
The GDPR applies to ‘personal data’ meaning any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier.
This definition provides for a wide range of personal identifiers to constitute personal data, including name, identification number, location data or online identifier, reflecting changes in technology and the way organizations collect information about people.
The GDPR applies to both automated personal data and to manual filing systems where personal data are accessible according to specific criteria.
Personal data that has been pseudonymised – e.g. key-coded – can fall within the scope of the GDPR depending on how difficult it is to attribute the pseudonym to a particular individual.
You must have a valid lawful basis in order to process personal data. There are six available lawful bases for processing.
The transition from the Directive to the GDPR introduces significantly broader territorial application of EU data protection law.
The accountability means that the controllers are responsible for, and must be able to demonstrate, compliance with the Data Protection Principles.
One of the key changes in the GDPR is that data processors have direct obligations for the first time. Under the GDPR, the concept of a “processor” does not change.
Consent must be freely given, specific, informed and unambiguous. Requests for consent should be separate from other terms, and be in clear and plain language.
Children are considered to be “vulnerable individuals” and have been given more rights under the GDPR than is the case for the existing Data Protect Act.
If you retain customer data, and particularly if your customers have accounts and you keep a customer record, you will need to look at how long you retain the data.
A privacy impact assessment will help you understand the risks and issues of using the customer data.
In certain circumstances data controllers and processors must designate a Data Protection Officer (the DPO) as part of their accountability compliance.
According to the GDPR, the data controller must notify for data breaches to the DPA. This must be done without undue delay and, where feasible, within 72 hours of awareness.
Whereas the remedies and sanctions available to DPAs under the Directive are comparatively low, the remedies and sanctions available to DPAs under the GDPR are significantly greater.
The ‘One-Stop-Shop’ mechanism is one of the key elements of the GDPR. The main idea is that it will greatly affect companies with a presence in more than one Member State.
A change has been made for the data controllers – they are no required to register or to notify the DPA of a controller’s data processing activities and to seek approval from the DPA in some circumstances.
One of the core dangers of transferring data out of the EEA is that those data will be subject to lower standards of protection. By adhering to Codes of Conduct, non-EEA controllers and processors can address this risk, and provide a lawful basis for Cross-Border Data Transfers.
Cross-Border Data Transfers are prohibited, unless certain conditions are met. Cross-Border Data Transfers to a recipient in a third country may take place, without a need to obtain any further authorization, if the Commission has decided that such third country ensures an adequate level of data protection.
GDPR allows supervisory authorities to assess penalties/fines that are effective, dissuasive and proportionate. There are two tiers of maximum penalties according to the GDPR, with a charge based on the severity of the violation:
Additionally, individuals can also solicit monetary damages in court from the organizations storing their data (controllers) that violate their rights as well as from companies that process their personal data (data processors).
May 25, 2018, is approaching soon, organizations are scrambling to ensure they are GDPR compliant. Make sure you are compliant too!
A data protection officer (DPO) is a security leadership role demanded by the General Data Protection Regulation (GDPR). Data protection officers are accountable for overseeing data protection strategy and implementation to ensure compliance with the most recent GDPR requirements.
Under the GDPR, you must appoint a DPO if you:
1. are a public authority (courts acting in their judicial capacity are not eligible);
2. carry out regular monitoring of individuals (for example, online behavior tracking);
3. carry out processing of particular data related to criminal convictions.
The GDPR is explicit about the responsibilities that DPOs are required to perform. They include the following:
Inform and guide the company and its employees of their data protection obligations under the GDPR.
Monitor the organization’s consent to the GDPR and internal data protection policies and modes. The following includes overseeing the assignment of responsibilities, awareness education, and training of staff involved in processing transactions and related activities.
Advise on the necessity of data protection impact assessments (DPIAs), the manner of their implementation and expected results.
Serve as the contact individual to the data protection officials and regular data subjects for all data protection issues, including data breach recording.
Yes. As long as the licensed activities of the employee fit with the duties of a DPO and will surely not lead to a conflict of interests in the company.
Additionally, you can also contract out the role of DPO externally.
Innovires Legal can help your company process personal data fairly and by following the GDPR law.
We have already been trusted by clients across a spectrum of regulated and non-regulated business sectors to work with them on their GDPR management, helping them to plan, budget and implement specific compliance projects, as well as evaluating their strategy and response to the change in risk profile.
Our integrated team can provide analysis and practical solutions as well as assist your business in preparing up for the deadline until GDPR takes effect. We will help you understand the impact it will have on your business and how to prepare smoothly.
Access this page and use one of the contact options to get in touch with our team.
Innovires Legal and its trusted and well-known IT and HR partners can help your company process personal data fairly and by following the GDPR law. We can fully assist you with:
25 Vitosha blvd. fl. 2, Sofia, Bulgaria
SEND MAIL
Working with clients on their most critical challenges often results in new industry perspectives and insights.
