The European General Data Protection Regulation (GDPR)

Many are discussing it and see its implementation as a major challenge: the European General Data Protection Regulation. It took the EU several years to create the regulation. As extensive sanctions are also provided for, it is important for companies to familiarise themselves with the various articles and implement appropriate measures.

On 25 May 2018, the 2-year transitional period for the already in-force General Data Protection Regulation (GDPR) ends. This means there is no further grace period for organisations, and the requirements brought about by the regulation must be fully met from this date onwards.

All companies and authorities that process personal data are affected, regardless of their sector or size. This data includes, for example, customer data, but also personnel data or IP addresses.

The GDPR addresses the protection objectives of data confidentiality, integrity, and availability. The resilience of IT systems and services is also intended to be ensured according to the regulation. Compliance with these objectives requires encryption methods, access controls, and methods for ensuring data integrity. It is advisable to rely on experts for the implementation of protective measures. The team at be-solutions helps companies with optimal GDPR preparation, including through encryption products and two-factor authentication.

In the new regulation, some articles resemble the Federal Data Protection Act, yet it encompasses many new requirements for companies across Europe. Here's an overview of the most important changes:

Duty to inform
When processing personal data, companies must inform data subjects about the duration and nature of storage. Among other things, they are obliged to provide information on the legal basis for data processing or, in the event of data being passed on to contract processors.

Reporting and notification obligations
If a data breach occurs within a company, the regulation requires this incident to be reported to the supervisory authority. The report should be comprehensive and submitted within 72 hours. The individuals affected must also be informed of the data breach.

Right to be forgotten
The „right to be forgotten“ grants individuals a right to erasure. This means they can have their data deleted from companies by a data controller. Once a request for erasure is received, the company must delete the data of the affected person immediately. If the data has been shared with third parties, the erasure request must be forwarded to them.

Data Protection Officer
Any organisation that employs at least 10 people on a permanent basis to process personal data is obliged to appoint a data protection officer. A decision can be made between an internal or an external appointment. It is important with an internal data protection officer that there is no conflict of interest with their areas of responsibility.

Fines
The changes in companies should be implemented within a few months, otherwise fines of up to 20 million euros or four percent of annual worldwide turnover are threatened. Furthermore, liability can no longer be delegated. This means that responsibility lies with the management and not with the data protection officer.