GDPR

Table of Contents

General Data Protection Regulation
What is GDPR?
Understanding GDPR
History of GDPR
Principles of GDPR
Impact of GDPR
Frequently Asked Questions

General Data Protection Regulation

It should come as no surprise that there would be strict laws protecting people’s data from large organisations and the government in a future where data is seen as the most valuable resource. In Europe, the GDPR, or General Data Protection Regulation, has replaced older data privacy laws that were nearly two decades old, some of which were initially developed in the 1990s. Since then, our data-intensive lives have developed, and individuals often share their private information online without restriction. The GDPR is the world’s most robust collection of data protection laws.

To provide European Union citizens additional access to their personal information, a new set of regulations known as GDPR was created. It seeks to streamline the regulatory landscape for business so that everyone in the EU—citizens and companies—can fully take advantage of the digital economy.

The GDPR establishes a new baseline for consumer rights surrounding personal data. Still, businesses will face challenges in implementing the necessary systems and procedures to remain compliant.

Although adopted in 2016 by the European Parliament, the law didn’t prevail until May 2018. GDPR replaced a previous law, the Data Protection Directive and also provides standards for how information is transmitted, whether done wholly or mostly by digital means. This new EU framework has ramifications for organisations in all member states, people, and enterprises throughout Europe and beyond.

In accordance with the terms of the GDPR, organisations are not only required to ensure that personal data is obtained legally and per strict guidelines but also that those who obtain and manage it are obligated to safeguard it from misuse and exploitation and to uphold the rights of data owners – or face penalties for doing otherwise.

GDPR replaces the 1995 Data Protection Act and sets specific data protection regulations. Organisations must protect user data from accidental or unauthorised access, destruction, alteration, or unauthorised use. They must also ensure that data is quality controlled to protect against unauthorised access, alteration, or destruction. Lastly, they must take steps to ensure that individuals have the right to information about their data protection rights and access to it.

Under the GDPR, organisations must provide customers with a data protection notice (DPN) specifying the specific rights that the customer has. Customers have the right to access their data, change their data protection settings, receive data protection notices in a Format that they can understand, and complain if they feel their rights have not been fully respected.

In recent years, there have been various changes to GDPR. Important modifications to the GDPR’s provisions were made in 2021. One example is removing the privacy shield established to facilitate economic transactions between US corporations and EU residents.

GDPR

The seven guiding principles of GDPR are:

Accuracy
Lawfulness, fairness & transparency
Data minimisation
Storage restriction
Integrity and confidentiality (security),
Accountability.

These principles are also known as the “core values” of the GDPR. However, one of the above principles, i.e., accountability, is new to data protection laws. The other principles are equivalent to those in place before the 1998 Data Protection Act in the UK.

The GDPR has significantly impacted how companies process and protect the personal data of EU citizens. Many companies have had to change their data collection and processing practices to comply with the GDPR. Some companies have also stopped doing business with the EU to avoid complying with the GDPR.

Under Article 83(5)(a), the highest administrative fines are applied to violations of the fundamental principles for processing personal data. This entails potential penalties of up to 4% of your entire annual international revenue or £17.5 million (US$21 million), whichever is larger.

Fines under the GDPR are discretionary instead of compulsory. They must be “effective, proportional, and dissuasive” and be used case-by-case.

Frequently Asked Questions

How do companies become compliant under GDPR?

Companies need to do a few key things to comply with GDPR.

First, they need to appoint a Data Protection Officer (DPO). This person is responsible for overseeing the company’s compliance with GDPR.

Second, companies must implement policies and procedures to ensure that personal data is collected, stored, and processed in a way compliant with GDPR. This includes ensuring that personal data is only collected for specific, legitimate purposes, stored securely, and authorised individuals only access it.
Finally, companies must provide individuals with information about their rights under GDPR and ensure they have a mechanism for exercising those rights.

What is GDPR compliance?

The term “GDPR compliance” refers to an organisation’s ability to handle personal data in accordance with the GDPR’s defined standards. To comply with the GDPR’s regulations on the use of personal data, enterprises must adhere to a set of rules. Moreover, it specifies eight rights for data subjects that offer some protections for people’s private information.

Who does GDPR apply to?

The GDPR applies to any company that processes the personal data of EU citizens, regardless of where the company is located. This includes companies based outside the EU that offer goods or services to EU citizens or that collect or process the personal data of EU citizens.

What is personal data under the GDPR?

Any information about a natural person (referred to as a “data subject”) that relates to their professional, personal, or public life and can be used to directly or indirectly recognise that person is referred to as personal data under GDPR law. Examples include names, photos, email addresses, or even bank records.

These also comprise any information that has been or might be connected to a person. Personal data includes a person’s phone number, credit card number, employee ID, account information, number plate information, appearance, customer number, or address.

When did GDPR come into force?

On April 14, 2016, the European Parliament adopted GDPR, which came into force on May 25, 2018.