Are You Ready for GDPR Compliance? How It Affects Any Company Doing Business with the European Union
30 January 2018 | by Christine Baird | Clarus – Real Estate & Business Solutions
Many companies in the U.S. and around the world either do not know what GDPR compliance is or believe it does not affect them – however, they need to know. And here is why.
The European Union’s (EU) General Data Protection Regulation (GDPR) will bring about the greatest change to European data security in 20 years.
Companies that collect data on citizens in EU countries will need to comply with strict new rules that protect customer data by May 25, 2018.
If your company processes personal data or sells goods or services to citizens in EU countries, then you will need to comply with GDPR.
The GDPR not only applies to organizations located within the EU but also to organizations outside of the EU if the company offers goods or services to, monitors the behavior of, or holds personal data of EU citizens.
What Personal Data?
Other countries and organizations may define personal data and information in different ways; however, GDPR defines personal data to include any information related to a person that can be used to directly or indirectly identify the person – such as a name, a photo, racial or ethnic data, an email address, bank details, posts on social networking websites, political opinions, health and genetic information, a computer IP address, and more.
GDPR focuses on the collection, processing, and movement of this personal information.
The Penalties
The GDPR penalties for non-compliance are steep – up to €20 million (about $24 million USD) or 4 percent of annual global turnover, whichever is greater.
This is the maximum fine that can be imposed for the most serious non-compliant and a tiered fine structure will be imposed on companies for lesser non-compliance offenses.
The “Data Subject” Rights
Per the GDPR regulations, some of the “Data Subject Rights” include:
Breach Notification – Under the GDPR, breach notification will become mandatory in all member states where a data breach is likely to “result in a risk for the rights and freedoms of individuals”. This must be done within 72 hours of first having become aware of the breach. Data processors will also be required to notify their customers, the controllers, “without undue delay” after first becoming aware of a data breach.
Right to Access – Part of the expanded rights of data subjects outlined by the GDPR is the right for data subjects to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, where and for what purpose. Further, the controller shall provide a copy of the personal data, free of charge, in an electronic format. This change is a dramatic shift to data transparency and empowerment of data subjects.
Right to be Forgotten – Also known as Data Erasure, the right to be forgotten entitles the data subject to have the data controller erase his/her personal data, cease further dissemination of the data, and potentially have third parties halt processing of the data.
Data Portability – GDPR introduces data portability – the right for a data subject to receive the personal data concerning them, which they have previously provided in a ‘commonly use and machine readable format‘ and have the right to transmit that data to another controller.
How to Be Compliant
To achieve GDPR compliance, all organizations should AIM – Assess, Implement, and Maintain.
The three key players to GDPR compliance that every company should have on board:
Data Controller
Data Processor
Data Protection Officer (DPO)
Since GDPR extends beyond cyber security, it is also important for Legal, IT and Security to work together to achieve compliance.
Organization executive management must make GDPR compliance a top priority and set a sense of urgency. Remember the Y2K last minute rush?
GDPR is a team effort and everyone within an organization has a responsibility to protect data and understand and get ready for GDPR compliance.
Clarus Real Estate and Business Consulting and has partnered with a team of IT and Compliance experts to analyze and advise on GDPR, KYC, Cybersecurity and business regulatory Compliance.
For more information, see www.ClarusRealEstate.com.