GDPR
The era of GDPR has arrived
0Days0Hours0Minutes0Seconds
it arrived on 25 May 2018.
Enforcement date: 25 May 2018 – after this date, organizations in non-compliance may face heavy fines.
If you process data about individuals in the context of selling goods or providing services to residences in EU countries, you are required to comply with GDPR. Non-compliance organizations are subject to be fined up to 4% of annual global turnover, or €20 Million. This is the maximum fine that can be imposed for the most serious infringements e.g. not having sufficient customer consent to process data or violating the principles of GDPR.
Whom does GDPR affect?
GDPR not only applies to organizations located within the EU but it will also impact organizations outside of the EU if they offer goods or services to, or monitor the behaviors of, EU data subjects. It applies to all companies processing personal data of data subjects residing in the European Union, regardless where are the companies.
What is Personal Data?
Any information related to a natural person or ‘Data Subject’, that can be used to directly or indirectly identify the person. It can be anything from a name, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer IP address.
What is the difference between a regulation and a directive?
A regulation is a binding legislative act. It must be applied in its entirety across the EU, while a directive is a legislative act that sets out a goal that all EU countries must achieve. However, it is up to the individual countries to decide how. It is important to note that the GDPR is a regulation, in contrast the previous legislation, which is a directive.
How to be compliant with GDPR
Compliance with GDPR is a bottom up management. The first thing is about your awareness and readiness in all levels of staff who will process the personal data in your organization processes. Follow the principles of GDPR which constitute the core requirements of GDPR, and establish relevant procedures of processing to meet the requirements of organizational measures of GDPR.
- Understand your data processing activities by conducting inventory of all the data and your processes.
- Find out if all data directly or indirectly collected are relevant to your specific purposes of processing and are compliant with the legal basis of GDPR.
- Provide required information to data subjects about your legal basis and how you will keep, use or transfer their data.
- Provide the channels or interfaces that data subjects can exercise their subject rights
- Comply with all the requirements about using a data processor or transmission data to 3rd countries.
- If you will keep the data in your organization, appropriate safeguards and protection by default should be met.
- In order to keep the compliance to GDPR, a DPO and privacy protection organization are recommended to be in place.
- Risk assessments, and compliance checking will help to find out necessary steps to meet all the requirements of GDPR.
CONTACT US！
