General Data Protection Regulation (GDPR) is a regulation in European Union (EU) law on data protection and privacy for all individuals within the EU. The regulation applies to all companies and organizations, including those located outside of the EU, that handle the personal data of EU citizens.
Passed by the European Parliament in April 2016, the GDPR replaces the 1995 Data Protection Directive and was designed to harmonize and unify data protection within all EU member states. It applies to the processing of personal data relating to any natural person (a person identified or identifiable) in the context of the activities of an establishment of a data controller (the party who determines the purposes and means of the data processing) in the EU, regardless of whether the processing occurs at an EU Member State or not.
The regulation introduces the concept of controller and processor, provides for an obligation to ensure data security, and gives data subjects (the individuals whose data is being processed) new rights in respect of their data, such as the right to be forgotten, the right to have their data rectified, and they right to obtain a copy of their data.
Leading up to the May 25th, 2018 enforcement date of the law, companies must take a number of steps to ensure their compliance. Organizations are required to assess their data processes, appoint a Data Protection Officer (DPO) if needed, and update their Privacy Policies to meet GDPR’s more stringent requirements. Organizations must also obtain explicit, informed consent before collecting data from EU citizens, keep records of all data processing activities, collect and store only the data required, secure personal data, conduct data protection impact assessments, and report any data security breaches within 72 hours.
Overall, the GDPR serves to protect the data of all EU citizens and impose strict rules on the handling of such data. Companies that fail to adhere to GDPR guidelines may be liable to pay significant fines.
