If you have not heard yet, the General Data Protection Regulations (GDPR) is a new regulation that will replace the current Data Protection Directive of 1995. It is intended to enhance and unify data protection for all individuals living in an EU member state.
You might ask, I don’t live in the EU, so how does that concern me. Well, if you have anything to do with the EU, it concerns you. If your website is visited by anyone in the EU, this concerns you. So pay close attention. The world is a global village, you can’t really stop people from visiting your site as long as your site is being crawled by Google and other search engines. We have outlined 7 things you need to know regarding GDPR.
1. The Definition of “Personal Data” Will Change
Normally we may assume that personal data is strictly related to account or ID numbers, as well as addresses and birthdate. While this is true, the GDPR regulation is expanding the definition of personal data.
Now, personal data will be related to “any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier.” By this, social, mental, economic, cultural, and even genetic information will now be considered personal data to be protected by GDPR requirements.
2. GDPR Compliance May Differ from One Company to the Next
GDPR compliance is likely to be quite different from one organization or company to the next. Compliance has a lot to do with a company size, the personal data that is collected via internal communications methods like a team app, as well as the goods and services offered. The best way to ensure your company complies with GDPR regulation by May 25, 2018, is to follow a GDPR checklist; it’s not too late to prepare yourself for the changes.
3. Who does the regulation apply to?
GDPR applies to any organisation that collects and controls personal data from EU citizens. It also applies to organisations that processes data on behalf of organisations. So this means that countries outside the EU that collects data from EU citizens are expected to comply.
4. What to do to prepare.
There are several areas to consider when preparing for the new GDPR regulation:
- Create a role for a Data Protection Officer – applies mainly to organisations with over 250 employees that have direct involvement with the collection and processing of data.
- Implement GDPR at board level, with direct responsibilities lying with the CIO, CISO and Data Protection Officer.
- Adopt risk management tools and implement security and privacy protocols into the Operations of the organisation (for example, develop a data privacy framework).
- Be concise and clear about data that is collected, what it is, where and how it is stored, how it is accessed and where it goes.
- Be confident that data held can be securely deleted when requested.
- Carry out regular and compulsory impact assessments.
- Ensure your IT infrastructure is setup to minimise the risk of a data leak or security breach. As part of the GDPR regulation it is required to report a data breach to a supervisory authority within 72 hours. (Source: http://orionglobalms.com)
5. Website Owners read this
Remember that enforcement commences on May 25, so all these must be in place before then.