General Data Protection Regulation (GDPR)

Who is excluded from GDPR compliance? 

The GDPR does not exclude businesses based on size, revenue or location, but it can exclude certain types of data such as: 

• Data processed by a natural person “in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity.”
• Anonymised information.
• Personal data of deceased persons.
• Data processing done in the context of national security or law enforcement.
• Data processing done in the context of journalism as it cannot suppress the free press.
• Data processing done in the context of education.
  
  

How can I keep my organization GDPR compliant? 

There are six principles that the GDPR outlines in Article 5 that help companies be compliant: 

• Lawfulness, fairness and transparency 

• Purpose limitation 

• Data minimization 

• Accuracy 

• Storage limitation

• Accountability 

These can be followed if you make sure to follow the below checklist: 

• Assess whether your company needs to appoint a DPO (based on volumes and types of data processed).
• Create a Privacy Notice and inform data subjects when you collect their data.
• Publicly display your company's name and contact information, as well as your DPO's name and contact information, if your company has assigned one. 
• Communicate European data subjects' rights clearly. 
• Empower data subjects to exercise their data privacy rights by setting up a method they can use to easily submit requests. 
• Verify the identity of data subjects before acting on the requests you receive. 
• Enforce internal processes to respond to the data subject's requests in time (30 days). 
• Update and communicate your cookie / data collection policies to include information on what personal data you collect, why, for how long, what is the legal base for collecting it, where you store the data and who you share it with. 
• Classify and map data, legal bases, processing purposes and data processors. 
• Ensure cookie compliance by asking users' consent before loading any scripts on your website. 
• Ensure the security of personal information through security and privacy practices. 
• Document that you collected consent before performing any processing activity that is governed by users' consent.
• Demonstrate that you have respected users’ rights and addressed their requests.
  
  

What are the 7 Data Subject Rights According to the GDPR? 

According to the GDPR, data subjects have the following rights:

• Right of Access: Data subjects have the right to obtain confirmation as to whether or not personal data concerning them is processed, and where that is the case they have the right to request and get access to that personal data.
• Right to be Forgotten: Officially called the “Right to Erasure”. In certain cases, data subjects have the right to obtain the erasure of their personal data.
• Right to Data Portability: Data subjects have the right to receive their personal data from data controllers in structured format and they have the right to (let) transmit such personal data to another controller.
• Right to Restriction of Processing: Under GDPR, data subjects have the right to obtain the restriction of processing, applicable for a certain period and/or for certain situations.
• Right to Object: In certain cases, data subjects have the right to object to processing of their personal data, including with regards to profiling. They have the right to object to further processing of their personal data insofar as such data has been collected for direct marketing purposes.
• Right to Rectification: Data subjects have the right to obtain the rectification of inaccurate personal data and they have the right to provide additional personal data to complete any incomplete personal data.
• Right to Reject Automated Individual Decision-Making: Data subjects have the right to not be subject to a decision based solely on automated processing.

How to address data subject access requests under GDPR?

Under the GDPR, companies also have less time to respond to data subject requests – one month instead of 40 calendar days. 

This legislative shift puts customers in the driving seat, something which holds a range of implications for companies with large banks of customer data. Today, companies need to be more transparent with the data they collect and they need to obtain explicit consent from the people they collect information from, or face big fines. GDPR obliges companies to confirm where data is being held, if they have deleted data, and what they will do with it. Previously it was often held in unsecured places and companies presumed that it was fine to simply take data. 

Additionally, the GDPR requires companies to correct or erase a customer’s personal data upon request, according to their rights. Individuals can also stop an organization from processing their data after a certain amount of time, or for certain situations. Furthermore, businesses must comply if an individual files a complaint about the way their data is being used, or if they object to having their personal data processed for any other purpose than those originally stated at the time of consent.

Upon receiving a data subject access request, you must:

• Verify the identity of the person who submitted the request;
• Make sure you understand the type of request;
• Review the information you send as your response to the request;
• Provide the data subject with the information in a format that is easy to access;

The General Data Protection Regulation (GDPR) mandates that your company should have a Data Protection Officer, also known as a DPO, who is responsible for monitoring and replying to requests. 

Enforcement and penalties under the General Data Protection Regulation (GDPR)

According to the GDPR, each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union (‘supervisory authority’).”

The supervisory authorities will assess each situation on a case by case basis and determine the penalties imposed, but the GDPR states that for severe violations of its provisions the penalties can get up to €20 million or 4% of annual global revenue, depending on which figure is higher.