What is GDPR?

The General Data Protection Regulation 2016/679(GDPR) will replace the actual Directive (Data Protection Directive). GDPR is focused on the protection of data subjects. It will be enforceable from May 25, 2018.

Organisations are encouraged to start preparing now, taking into account that some obligations may be onerous and time-consuming to implement. Both administrative fines and legal proceedings can be placed against organisations found to be in violation of the regulations. Regulatory bodies across the EU have been given the power to enforce greater financial penalties than ever before. These fines are a maximum of € 20,000,000 or 4% of the total worldwide turnover for the parent company in the previous financial year, whichever is the greater value. The only way to minimise a fine is to show your steps towards compliance. From the outset be aware the GDPR is not just an IT problem.

If you store, collect, process or transmit data you’re in scope and have to comply with the GDPR. The GDPR applies to processing carried out by organisations operating within the EU. It also applies to organisations outside the EU that offer goods or services to individuals in the EU.

When processing any sensitive or personal data as either a data controller or processor you must take appropriate technical measures to secure data against accidental loss, damage or destruction and provide explicit consent for processing each service.

The adoption of internationally recognised management system standards such as ISO 27001: 2013 Information and Data Security demonstrate an organisations active vigilance and preparedness to firstly achieve compliance and thereafter maintain compliance with the GDPR.