The General Data Protection Regulation (GDPR) applies to organizations that conduct business in Europe to ensure the protection of confidential data for citizens in the European Union (EU). This is true for companies no matter where they operate. If you do business with EU citizens, you must comply with the GDPR, which means that almost every major corporation and media group in the world is affected.

The mission of the GDPR is to protect EU citizens from data breaches as a result of transactions that occur within EU member states. The enforcement date for the new GDPR is May 25, 2018, and non-compliance could have major repercussions for your business.

Organizations that don’t comply with the new GDPR can be fined up to 4% of their annual global turnover or €20 Million ($24,959,600.00), whichever is greater.

The 28 EU member countries include: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, and the United Kingdom.

Why You Should Be Concerned

Many business owners and managers in the U.S., Canada and elsewhere aren’t prepared for GDPR enforcement. They don’t realize that even though they aren’t located in the EU, they’re still liable. Any company that processes the personal data of EU citizens or residents must comply with the GDPR or face hefty fines.

Plus, many companies have concerns with the new GDPR because it mandates that consumers’ data must be “reasonably protected” – yet it doesn’t specify what this means.

Compliance is worrisome for many because:

• The GDPR takes a wide view of what personal identification information is, and it’s not always clear what needs to be protected.
• They must provide the same high-level protection for people’s IP addresses, and cookie data for names, addresses and government identification information like National Insurance Numbers. (Cookie data is a text file that a Web browser stores on a user’s computer.)
• Regulations apply to the processing of personal data by controllers and processors, regardless of whether it takes place in the EU or not.
• The GDPR also applies irrespective of whether payment is required or the monitoring of behavior that takes place within the EU.
• Rules apply to both controllers and processors. This means that cloud solutions aren’t exempt from GDPR enforcement.
• The conditions for consent are now more stringent. Companies can no longer use long terms and conditions in legalese. Consent must be provided in an easy-to-understand format, and in plain language.
• Non-EU businesses processing the data of EU citizens must appoint a representative in the EU.
• Businesses can only process personal data that’s absolutely necessary and must limit access to only those who require it for the completion of their duties.
• If a breach does occur, breach notification must be completed within 72 hours of first having become aware of it. Businesses must notify their customers, controllers, and authorities without delay.

How to Prepare for the New GDPR.

Be sure that you fully understand how the requirements affect your business. Is your company a data controller or a data processor?

• A data controller is a person or entity that determines how to use data and for what.  As a controller, you are responsible for any problems that involve personal data.
• A data processor is responsible for obtaining, recording, adapting, or holding people’s personal information. As a processor you work on behalf of the controller, so your liability isn’t as great as theirs. However, processors share controllers’ responsibility when it comes to how the data is processed.

If a person’s personal data is exposed, the data processor is liable if the manner the data was processed isn’t in compliance with the GDPR. Furthermore, the data controller is liable for the data leakage or fraud because they delegated the transfer of data to the processor who is non-compliant. In other words, both can be fined.

Implement GDPR Now Before the New Regulations Take Effect.

The size of your organization and the complexity of your IT systems and operations will influence the extent and cost of your GDPR implementation. If you use an IT Managed Services Provider who already has this expertise, you’re in luck. They can take care of the implementation for you. If you don’t, you may need to hire additional, qualified IT staff.

GDPR inspections are conducted by the European Commission. If you don’t implement GDPR processes, and you handle personal information for people in the EU that’s compromised, you can face penalties that not only result in fines but legal ramifications as well. Once the public finds about any infractions, the credibility of your business is at risk.

You must assign a DPO before May 28, 2018. 

One thing you must do is designate a Data Protection Officer (DPO) for your business. Your DPO is responsible for overseeing your data protection strategy and implementation to ensure compliance. The problem is that the GDPR hasn’t provided a list of DPO credentials. They only state that the DPO must have “expert knowledge of data protection law and practices”.

Your Data Protection Officer must be able to:

• Educate and advise your employees about their obligations to comply with data protection laws and the GDPR.
• Monitor compliance with GDPR and data protection laws, manage data protection activities, provide advice on compliance assessments, and conduct internal audits.
• Act as the point of contact for supervisory authorities and for anyone whose data is processed by your organization

Your DPO can be a staff member as long as they can manage data controlling and processing activities and be readily available for contact whenever required. However, you must ensure that the duties of your DPO don’t result in a conflict of interest. If so, this could result in fines of up to EUR 10 million ($12,437,357.29), or up to 2 percent of your global annual turnover (whichever is greater).

Most businesses prefer to hire an external Data Protection Officer to avoid any conflict of interest.  Consult with your IT Managed Service Provider to see if one of their IT professionals can act as your DPO.  

Take Action Now.

It seems that everything we do today involves using and processing data. The good news is that the GDPR will give EU citizens the peace of mind that their personal data will be processed, stored and transferred securely.

Don’t wait until May 25, 2018 – failing to meet the GDPR could have a disastrous effect on your business. Take the time to be informed, review the legislation and ensure that your business remains compliant.