GDPR

GDPR
The General Data Protection Regulation (GDPR) is the toughest privacy and security law in
the world. Though it was drafted and passed by the European Union (EU), it imposes
obligations onto organizations anywhere, so long as they target or collect data related to
people in the EU. The regulation was put into effect on May 25, 2018. The GDPR will levy
harsh fines against those who violate its privacy and security standards, with penalties
reaching into the tens of millions of euros.
With the GDPR, Europe is signaling its firm stance on data privacy and security at a time
when more people are entrusting their personal data with cloud services and breaches are a
daily occurrence. The regulation itself is large, far-reaching, and fairly light on specifics,
making GDPR compliance a daunting prospect, particularly for small and medium-sized
enterprises (SMEs).
Data protection principles

1. Lawfulness, fairness and transparency - Processing must be lawful, fair, and
transparent to the data subject.
2. Purpose limitation - You must process data for the legitimate purposes specified
explicitly to the data subject when you collected it.
3. Data minimization - You should collect and process only as much data as absolutely
necessary for the purposes specified.
4. Accuracy - You must keep personal data accurate and up to date.
5. Storage limitation - You may only store personally identifying data for as long as
necessary for the specified purpose.
6. Integrity and confidentiality -Processing must be done in such a way as to ensure
appropriate security, integrity, and confidentiality (e.g. by using encryption).
7. Accountability -The data controller is responsible for being able to demonstrate
GDPR compliance with all of these principles.
Accountability
The GDPR says data controllers have to be able to demonstrate they are GDPR compliant.
And this isn’t something you can do after the fact: If you think you are compliant with the
GDPR but can’t show how, then you’re not GDPR compliant. Among the ways you can do
this:
 Designate data protection responsibilities to your team.

 Maintain detailed documentation of the data you’re collecting, how it’s used, where
it’s stored, which employee is responsible for it, etc.
 Train your staff and implement technical and organizational security measures.
 Have Data Processing Agreement contracts in place with third parties you contract to
process data for you.
 Appoint a Data Protection Officer
Data security
You’re required to handle data securely by implementing “appropriate technical and
organizational measures.”
Technical measures mean anything from requiring your employees to use two-factor
authentication on accounts where personal data are stored to contracting with cloud
providers that use end-to-end encryption.
Organizational measures are things like staff trainings, adding a data privacy policy to your
employee handbook, or limiting access to personal data to only those employees in your
organization who need it.
If you have a data breach, you have 72 hours to tell the data subjects or face penalties.
Data protection by design and by default

From now on, everything you do in your organization must, “by design and by default,”
consider data protection. Practically speaking, this means you must consider the data
protection principles in the design of any new product or activity.
Suppose, for example, you’re launching a new app for your company. You have to think
about what personal data the app could possibly collect from users, then consider ways to
minimize the amount of data and how you will secure it with the latest technology.
When you’re allowed to process data

Article 6 lists the instances in which it’s legal to process the data. Don’t even think about
touching somebody’s personal data — don’t collect it, don’t store it, don’t sell it to
advertisers — unless you can justify it with one of the following:
 The data subject gave you specific, unambiguous consent to process the data.
 Processing is necessary to execute or to prepare to enter into a contract to which the
data subject is a party.
 You need to process it to comply with a legal obligation of yours.
 You need to process the data to save somebody’s life.
 Processing is necessary to perform a task in the public interest or to carry out some
official function.
 You have a legitimate interest to process someone’s personal data. This is the most
flexible lawful basis, though the “fundamental rights and freedoms of the data
subject” always override your interests, especially if it’s a child’s data.
Once you’ve determined the lawful basis for your data processing, you need to document
this basis and notify the data subject (transparency!). And if you decide later to change your
justification, you need to have a good reason, document this reason, and notify the data
subject.
Consent
 Consent must be “freely given, specific, informed and unambiguous.”

 Requests for consent must be “clearly distinguishable from the other matters” and
presented in “clear and plain language.”
 Data subjects can withdraw previously given consent whenever they want, and you
have to honor their decision. You can’t simply change the legal basis of the
processing to one of the other justifications.
 Children under 13 can only give consent with permission from their parent.
 You need to keep documentary evidence of consent.
People’s privacy rights

You are a data controller and/or a data processor. But as a person who uses the Internet,
you’re also a data subject. The GDPR recognizes a litany of new privacy rights for data
subjects, which aim to give individuals more control over the data they loan to organizations.
As an organization, it’s important to understand these rights to ensure you are GDPR
compliant.
Below is a rundown of data subjects’ privacy rights:
 The right to be informed.

 The right of access
 The right to rectification
 The right to erasure
 The right to restrict processing.
 The right to data portability
 The right to object
 Rights in relation to automated decision making and profiling.

GDPR

Uploaded by

Copyright:

Available Formats

GDPR

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

GDPR

Uploaded by

Copyright:

Available Formats

GDPR

Data protection principles

 Designate data protection responsibilities to your team.

Data protection by design and by default

When you’re allowed to process data

 Consent must be “freely given, specific, informed and unambiguous.”

People’s privacy rights

 The right to be informed.

You might also like