The new EU General Data Protection Regulation – How well are you prepared?
The General Data Protection Regulation (GDPR) will come into effect as of 25th May 2018. All 500 million citizens of the European Union (EU) and around 20 million companies will have to comply with this regulation which will have significant consequences.
The regulation is also binding for companies not present in the EU. Any company which trades with the EU or which handles data relating to persons is subject to the new regulation. This in particular affects US companies as such organisations have a much laxer regulation with regard to person related data.
There are five significant factors which need to be addressed:
The data subject has a right to see stored data and has the right to erase such data in the interest of fundamental rights.
- There shall be an adequate level of security of personal data
- Personal data may only be used if the data subject agrees, or if it is necessary or a legal requirement
- Compliance with GDPR must be demonstrated
- Organisations must demonstrate organizational and technical competence
Compliance with the new regulation is not going to be simple. The process is complex, time consuming and will in all likelihood result in investment and thus increased expense. On the other hand, such costs are significantly less than the proposed fines and other consequences. Should companies and organisations not comply with GDPR they face fines of up to 20 million Euros or 4% of global turnover – whichever is higher. In addition the Regulators can order a shut-down of business if they suspect that a company or organisation is not acting in accordance with the regulation.
There are, however, advantages to being compliant with GDPR. Besides avoiding fines or a shut-down, compliance with the regulation leads to an improved company image and it leads to a competitive advantage. Furthermore, compliance should also result in an optimized IT strategy which in turn can result in reduced costs.
IDC, a consultancy company, comes to sobering conclusions in a study published in August 2017. In spite of German legislation for all companies to have a Data Protection Officer, only 17 % of German companies have filled such a post. Furthermore only 15 % of German companies were compliant with GDPR at the time. Only 41% of those questioned are partially compliant are are in the process of implementation. 44 % have not begun implementation.
The implementation of GDPR is the first step towards a single European digital market which forms the basis for the digitalization of the EU and all those who deal and trade with the EU. Only those companies and organisations which are in compliance with the new regulation will be successful. The digitalization of Europe kicks off on 25th May 2018.
Disclaimer: Assessments of security situations are based on the information available at the time specified and assessed as trustworthy by German Business Protection (GBP). Although the compilation of the information was handled with extreme care, GBP cannot be made responsible for the timeliness, accuracy or completeness of the article. In no event GBP can be held responsible for any damage of any kind arising from the use of the information provided here, whether direct or indirect or consequential damages, including lost profits. Hazardous situations are often confusing and can change rapidly.