GDPR

What Is GDPR?

GDPR or General Data Protection Regulation is a set of rules designed for giving EU (European Union) and EEA (European Economic Area) citizens power over how their personal data is collected and used online. The aim of the GDPR is to simplify the regulatory environment for businesses so that businesses, as well as citizens in the European Union, can take benefit from the digital economy. The demand for GDPR is greater accountability as well as transparency from organizations regarding how they collect, store and process personal information online.

Steps For GDPR Compliance Requires

• Establishing accountability as well as a governance framework

              1) Brief management of GDPR risks as well as benefits.
              2) Management support for the GDPR compliance project.
              3) A director who will be responsible for GDPR.

• Plan as well as scope your project

          1) Appointing as well as training project manager along with DPO.
         2) Identifying entities that will be in scope.

• Conducting data inventory as well as data flow audit

          1) Assessing data categories as well as the lawful basis of processing.
          2) Data flow must be mapped within the organization.
          3) Using a data map for identifying the risk in data processing activities as well as whether the data protection impact assessment is required.

• Conducting detailed gap analysis.

                1) Auditing current compliance position against GDPR requirement.
                2) Identifying compliance gaps that require remediation.

• Developing operational policies and procedures.

            1) Creating a record of personal data processing activities which are drawn from data flow audit as well as gap analysis.
            2) Bringing data protection policies as well as privacy notices in accordance with GDPR.
            3) Update as well as review employees, suppliers, and customer contracts.
            4) Plan how to recognize as well as handle data access requests and provide responses within a month.
            5) Have a process for determining if DPIA is needed.
            6) Securing personal data through the right procedure as well as technical measures.
            7) Ensuring that all policies, as well as procedures, are in place for investigating the personal data breach.
         8) Reviewing if the data transfer mechanism outside the EU is compliant.

• Communication

           1) Fruitful internal communication with stakeholders.
           2) Employees are required to understand data protection’s importance and be trained on GDPR principles and procedures that must be implemented.

GDPR Checklist For Small Businesses

• You have to reveal types of personal data’s understanding that you hold along with the source from where they are coming from.
• Identify if one is depending on consent to processing personal data. If it is difficult to identify under the GDPR since the consent might not be clear and explicit, avoid trusting in the consent.
• Security measures, as well as policies, need to be updated as GDPR-compliant. Broad use of encryption will reduce the probability of a big penalty in case of a breach.
• Be prepared for meeting access requests within a month. Since Subject Access Rights keeps on changing and under the GDPR people have full privilege for accessing their personal data and rectifying whatever is inaccurate.
•  Due diligence on your supply chain must be conducted ensuring that all suppliers besides contractors are compliant with GDPR
•  It is needed for creating fair processing notices describing to people what you are doing with their personal data.
• Decide if there is a need to employ a Data Protection Officer (DPO) for carrying out everything in a legal and amicable manner.

Penalties of GDPR

GDPR has a huge penalty structure and the rules are applicable to both processor as well as data controllers in the cloud and thus, huge cloud providers aren’t off the hook during GDPR enforcement. Here non-compliance may result in global revenue’s fine of up to 4%.

Some Other Important Points About GDPR

• It’s not necessary for a business to be GDPR certified but at the same time, it encourages voluntary certification through voluntary bodies or organizations who are obedient with EN-ISO/IEC 17065/2012.
• The deadline for GDPR compliance is May 25th 2018 and there isn’t any grace period for it.
• There isn’t any requirement for timely governmental audits as well as inspection however supervisory authorities have the right for carrying audits.
• GDPR can affect anyone in the economic activity irrespective of the size of the business.
• Saga is making an effort to ensure that all its active products are ready for GDPR.
• GDPR requirement supersedes every existing government law regarding data protection for EU member states.
• The UK government is implementing GDPR in new data protection law through data protection bill and will continue to be effective as soon as Brexit takes place in 2019.
• Finally, GDPR can also affect any business all over the globe that process individual data in the EU. It is necessary to employ representatives in the EU for handling GDPR enquiries if it is offering goods as well as services to people in the EU along with monitoring their behaviour.