iscover
ReporterShare this article on:
Powered by
MOMENTUM
MEDIA
Enforced in May 2018, the General Data Protection Regulation (GDPR) brought significant changes to how businesses handle the personal data of European Union citizens.
Whether you are a business owner, a consumer, or simply curious about data protection laws, here are three key things you need to know about the GDPR:
1. Scope and applicability
The GDPR is a comprehensive data protection regulation that applies to any organisation, regardless of its location, that processes the personal data of EU residents. This means that even if a business is based outside of the EU, as long as it offers goods or services to EU citizens or monitors their behaviour, such as through cookies or online tracking, it must comply with the GDPR. This extraterritorial scope has brought many non-EU businesses into the fold of GDPR compliance.
Furthermore, the GDPR defines personal data broadly, encompassing any information that can directly or indirectly identify an individual. This includes names, email addresses, IP addresses, financial details, and even photos. As a result, businesses need to be more diligent in handling any personal data they collect.
2. Data subject rights
Under the GDPR, individuals enjoy enhanced rights over their personal data. Businesses must be transparent about how they collect, process, and store data and provide clear privacy policies to their users. Data subjects have the right to know what data is being collected, for what purposes, and with whom it is shared. They can also withdraw their consent at any time and request the deletion of their data (the “right to be forgotten”) under certain conditions.
Additionally, data subjects can obtain a copy of their data in a portable format, allowing them to transfer their information easily between different service providers. These rights give individuals greater control over their personal data and place more accountability on businesses to handle data responsibly.
3. Penalties for non-compliance
The GDPR has teeth when it comes to enforcement. Organisations found in violation of the regulation can face severe penalties. The fines can be up to 4 per cent of the company’s global annual revenue or €20 million, whichever is higher. For smaller infractions, lower-level fines can still be significant at 2 per cent of annual global revenue.
These penalties have prompted businesses worldwide to take GDPR compliance seriously. Data breaches are a primary concern under the GDPR, and companies must promptly report any breaches to the relevant supervisory authority and affected individuals. Implementing adequate data protection measures, conducting regular risk assessments, and educating employees on data security are essential steps to avoid non-compliance.
Embracing GDPR compliance not only ensures a company’s legal standing but also demonstrates a commitment to safeguarding the privacy of individuals in an increasingly data-driven world.
Be the first to hear the latest developments in the cyber industry.
