Are you prepared for the new European Union Data Protection Regulation?
The General Data Protection Regulation (GDPR) of the European Union will come into effect on 25th May 2018. All 500 Million citizens of the EU and around 20 Million active companies will have to conform to this supranational regulation which contains a number of new aspects.
The Regulation also applies to companies outside the EU. If an overseas company offers products or services within the EU or if it uses or handles personal data, it too must conform to the new Regulation. This affects US companies in particular as US regulations governing the handling of personal data is considered to be lax by EU standards.
There are five main pillars underpinning the new Regulation which need to be implemented in order to be compliant with the new Regulation:
§ Extended rights of affected persons including data-access and deletion
§ An acceptable level of security in storage and transmission of personal data
§ Use of data must be approved or otherwise legal
§ Compliance with the Regulation has to be demonstrated
§ Proof of technical and organizational levels of competence must be demonstrated
It will not be easy to comply with the new Regulation. The process is complex, takes time and can involve added cost or new investment. On the other hand the penalties for not conforming are significantly higher. In such a case companies can be fined up to 20 Million Euros or 4% of global turnover – whichever is higher. On top of that, the authorities can shut down the offending company should they simply suspect that the Regulation is not being implemented.
There are, however, advantages in complying with the Regulation. Besides avoiding hefty fines or shut-downs it can be argued that compliance to the Regulation enhances the image of the company. Being compliant can also lead to optimizing data flow and organisation which in turn can result in lower back office costs.
A recent study by Consultants IDC has come to disturbing results: In spite of legislation only 17 % of German companies have a data protection officer. Furthermore, a few months before coming into effect, only 15 % of German companies consider themselves compliant with the new Regulation. The report goes on to say that 41 % are partially compliant and that 44 % have not even begun.
The implementation of the new Regulation is the first step towards a unified European digital market. It forms the basis for the digitalization of Europe and all those companies outside the Union who wish to be a part of this change. Only those companies who comply with the Regulation can be a part of this. The 25th May is truly the day the digitalization of Europe kicks off.
Disclaimer: Assessments of security situations are based on the information available at the time specified and assessed as trustworthy by German Business Protection (GBP). Although the compilation of the information was handled with extreme care, GBP cannot be made responsible for the timeliness, accuracy or completeness of the article. In no event GBP can be held responsible for any damage of any kind arising from the use of the information provided here, whether direct or indirect or consequential damages, including lost profits. Hazardous situations are often confusing and can change rapidly.