GDPR: Do You Know if Your Organization Needs to Comply?

Many have heard tidbits about the acronym “GDPR,” but do not understand the regulation or feel that it doesn’t apply to their organization since it is a European Union law. Surprisingly, even without locations or affiliations in the EU, companies here in the United States may be subject to hefty fines for noncompliance.

In addition to the risk of damaging reputation, noncompliance with the GDPR may have significant financial consequences. Data protection supervisory authorities may impose administrative fines of up to €20 million or 4 percent of the total global turnover. This should cause concern and make GDPR compliance the utmost importance for organizational leadership. (Not complying with the GDPR can also make you a target for cybercrime. Learn more in How Cybercriminals Use GDPR as Leverage to Extort Companies.)

Where does it apply and what is the impact?

The General Data Protection Regulation (GDPR), put into place by the European Union on May 25, 2018, is designed to ensure that organizations are adequately protecting the privacy rights of individuals concerning the processing of personal data. It is the most significant change in data privacy in the EU in more than 20 years.

The GDPR applies to all organizations that have an establishment in the EU, but also, it marks a significant expansion of the territorial scope of the EU data protection regime. This extra-territorial reach is triggered if companies meet one or more of the following conditions:

• Goods and services are offered to EU citizens
• The behavior of EU citizens is monitored (e.g., by using cookies on websites)
• Personal data is processed in the context of an establishment (e.g., an affiliate) in the EU

How do companies demonstrate compliance with GDPR?

The GDPR sets out seven major principles that all organizations are required to comply with when they process personal data:

Accountability is one of the most important new requirements under the GDPR. Accountability means that the organization must show that it can comply with the GDPR. Companies must be able to demonstrate compliance to meet the accountability requirement, which includes:

• Appointing a data protection officer or local representative, where necessary
• Completing and maintaining records of data processing activities
• Assessing the appropriate level of data security and implementing appropriate technical and organizational security measures
• Implementing data protection by design and by default and documenting the measures taken; carrying out data protection impact assessments, where necessary

It’s about protecting the data privacy rights of individuals!

The GDPR defines “data subjects” as “identified or identifiable natural person[s].” In other words, EU citizens that may be employees, customers, suppliers, or others from whom or about whom companies collect information in connection with business and/or operations. The GDPR also spells out certain rights for its data subjects:

Organizations should have procedures in place to respond to data subject requests (DSRs) regarding the rights mentioned above. The legal basis, processing data, or other factors will dictate how your organization responds to a DSR, so it is essential to consult with legal professionals that have expertise regarding the GDPR. (Protecting customer data is paramount in the GDPR. Learn more in Is Your Customer Data Really Safe? How It Can Be Exposed.)