The (GDPR) General Data Protection Regulation is the data privacy law that regulates the way organizations across the EEA (European Economic Area) process the personal data of individuals generally referred to as ‘data subjects.’ Its aim is to change the way EU citizens’ personal data is collected, processed and stored, transferring the power over personal data from companies to data subjects.
Oftentimes small and medium-sized enterprises (SMEs) who may be processing the personal data of their staff, customers, and/or business partners might find it difficult to understand what compliance with the GDPR means. Because of this, the European Data Protection Board has published the Data Protection Guide for Small Businesses, to help SMEs navigate the data privacy law and understand their obligations as regards the protection of personal data, which we will discuss in the current as well as subsequent posts.
The Guide is organized into four main sections:
In this post we will look at the first point, Data Protection Basics.
The first step to understanding the GDPR is understanding what personal data is and what it includes. According to the law, personal data means any information relating to an identified or identifiable individual. There are types of personal data that can be used to identify a data subject either directly or indirectly. For example, if your organization processes information such as an individual’s booking reference or their individual customer number, this may allow the indirect identification of the individual.
In addition to the above there are some types of personal data, called sensitive data or special categories of personal data, which have a different protection regimen. Article 9 of the GDPR lists types of sensitive personal data that reveals details about “racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, [...] genetic data, biometric data, health, or a natural person’s sex life or sexual orientation.” Unless specific circumstances apply, such as explicit consent, the processing of sensitive data is prohibited.
The same applies to personal data concerning criminal convictions and offenses which, according to Article 10 of the GDPR, can only be processed “only under the control of official authority or when the processing is authorized by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects.”
You can read our overview of the GDPR by navigating to our website’s Resources section where you will find it listed among the other privacy regulations Clym supports currently. For your convenience, here is a direct link to our EU GDPR Overview.