GDPR – General Data Protection Regulation
The General Data Protection Regulation (GDPR) is an EU regulation by which the European Parliament, the Council of the European Union and the European Commission intend to strengthen and unify data protection for all individuals within the European Union (EU).
Downloads
What is GDPR?
The General Data Protection Regulation 2016/679 (GDPR) will replace the actual directive (Data Protection Directive). GDPR is focused on the protection of data subjects. It will be enforceable from May 25, 2018. Organisations are encouraged to start preparing now, taking into account that some obligations may be onerous and time-consuming to implement.
Both administrative fines and legal proceedings can be placed against organisations found to be in violation of the regulations. Regulatory bodies across the EU have been given the power to enforce greater financial penalties than ever before. These fines are a maximum of € 20,000,000 or 4% of the total worldwide turnover for the parent company in the previous financial year, whichever is the greater value. The only way to minimise a fine is to show your steps towards compliance. From the outset, be aware that GDPR is not just an IT problem.
Article 5 of the GDPR requires that personal data shall be:
- Processed lawfully, fairly, and in a transparent manner in relation to individuals.
- Collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
- Adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.
- Accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that is inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay.
- Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
- Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organisational measures.
Why IMSM?
Simple: We make it simple. Since 1994, we’ve been helping businesses achieve ISO certification and have over 150 experts worldwide. With 15,000+ clients trusting us to implement their ISOs, we have proven to be experts capable of handling the logistical heavy lifting, saving your company precious time. With a transparent fixed fee, flexible approach, and real-time access to updates, documentation, and an array of other features through IMSMLoop, we work with your organisation to make ISO implementation as straightforward and beneficial as possible.
We strive to do this with our:
– World-class gap analysis
– Experienced and diverse ISO consultants
– Regular updates, provided through IMSMLoop
– Flexible terms and contract
– Fixed fee
– Full implementation
How can ISO specialists help your business?
Getting started with ISO certification can seem like a daunting process, which is why many businesses choose to use the help of an ISO consultant. We support and guide your business through certification. Our experienced assessors take the lead on auditing your business, helping you use the results to improve your quality management system. If necessary, there is also plenty of room for training.
FAQs
- How can organisations prepare?
The adoption of internationally recognised management system standards such as ISO/IEC 27001 information and data security demonstrates an organisation’s active vigilance and preparedness to achieve compliance and maintain compliance with GDPR. - How are GDPR and ISO/IEC 27001 related?
ISO/IEC 27001 is a framework for information protection. According to GDPR, personal data is critical information organisations must protect. Some GDPR requirements are not directly covered in ISO/IEC 27001, such as supporting the rights of personal data subjects: the right to be informed, the right to have their data deleted, and data portability. But, if the implementation of ISO/IEC 27001 identifies personal data as an information security asset, much of the GDPR requirements will be covered.
Contact Us
For a free Quotation or On-Site presentation by an ISO Specialist, contact us today!
8 Queen’s Road East
Wanchai,
Hong Kong