Understand everything you need to know about GDPR now that the May 25th deadline has passed.
How Prepared are You?
This overhaul of EU data protection regulation is the most significant in recent history and impacts any organization who does business internationally. Therefore, any US-based company that targets consumers in the EU, monitor EU citizens or offer goods or services in the EU (even if it is free) have to comply.
Organizations who are not GDPR compliant by the deadline can be fined up to 4% of annual global turnover or 20 Million Euros, per incident.
The General Data Protection Regulation (GDPR) is designed to give data control back to the individual, rather than it be controlled by an organization. With GDPR, an individual reserves the right to control an organization’s access to their personal data while also improving the way data is protected and processed. Under GDPR, one has the right to access, adjust or completely remove personal user data upon request.
Introduced to keep pace with the modern digital landscape, the GDPR is more extensive in scope and application than the current Data Protection Act (DPA) and requires organizations to develop clear policies and procedures to protect personal data, and adopt appropriate technical and organizational measures.
UK organisations handling personal data will still need to comply with the GDPR, regardless of Brexit. The GDPR will come into force before the UK leaves the European Union, and the government has confirmed that the Regulation will apply, a position that has been confirmed by the Information Commissioner.
The MDS compliance team has wide-ranging data protection expertise to help organizations prepare for the GDPR. We offer a comprehensive suite of information, resources, and compliance solutions services. MDS will take a look at your current IT infrastructure and highlight the areas in which you are non-GDPR compliant. We will then create a custom roadmap to highlight the steps necessary to become GDPR compliant, and facilitate the implementation.
There are 10 Key Facts Businesses need to know about the new regulation:
1. GDPR Applies to All
This means that any company that works with information relating to EU citizens will have to comply with the requirements of the GDPR, making it the first global data protection law.
2. The GDPR widens the definition of personal data
Companies should take measures to reduce the amount of personally identifiable information they store, and ensure that they do not store any information for longer than necessary.
3. Tighter regulations for obtaining valid consent to use personal information
Once GDPR is in effect, it will be more important than ever for organizations to explain exactly what personal data they are collecting and how it will be processed and used. Without valid consent, any personal data processing activities will be shut down by the authorities
4. A designated Data Protection Officer (DPO) is required
5. Privacy Impact Assessments (PIAs) are mandatory
Before organisations can even begin projects involving personal information, they will have to conduct a privacy risk assessment and work with the DPO to ensure they are in compliance as projects progress.
6. Data Breach Notifications are mandatory
Organisations need to therefore ensure they have the technologies and processes in place that will enable them to detect and respond to a data breach.
7. The GDPR introduces the right to be forgotten
8. Liability beyond data controllers is expanded
Even organizations that are purely service providers that work with personal data will need to comply with rules such as data minimization
9. Privacy by design is required
Moving forward, all software will be required to be capable of completely erasing data, which will be a challenge for a lot of software engineers
10. The GDPR introduces the concept of a one-stop shop
The benefit for business is that they will have to deal with only one supervisory authority rather than a different one for each EU state.
MDS Compliance Resources
GDPR Compliance: Gap Analysis Workshop
MDS and partner law firm BurgherGray to break down GDPR and what steps to take when becoming compliant.
How Prepared are You for GDPR?
Our GDPR Readiness Survey is an online, self-evaluation tool that will give you a letter grade of your organization’s GDPR readiness.
Step-By-Step GDPR Compliance Checklist
Better manage the necessary steps to become GPDR compliant by using this step-by-step breakdown as your guide.