The EU General Data Protection Regulation (GDPR)
What is the GDPR?
The EU's GDPR (General Data Protection Regulation) is a pan-European data protection law, which superseded the EU’s 1995 Data Protection Directive, and all member state law based on that directive, on 25 May 2018.
Significant and wide-reaching in scope, the new law brings a 21st-century approach to data protection. It expands the rights of individuals to control how their personal data is collected and processed, and places a range of new obligations on organisations (both controllers and processors) to be more accountable for data protection.
The GDPR also gives member states limited opportunities to make provisions or derogations for how the Regulation applies in their country; Ireland has done so via its Data Protection Act 2018 which came into effect from 25 May 2018.
GDPR – an ongoing compliance journey
25 May 2018 was just the beginning – the GDPR requires clear evidence of an organisation’s ongoing commitment and compliance efforts. You must ensure that you maintain your data processing practices to adequately address any emerging privacy and security risks.
If you have not yet started your GDPR journey, you should prioritise tackling those areas where a lack of action leaves your organisation exposed. When an infringement occurs, demonstrating you have made a start could help reduce potential penalties.
GDPR compliance overview
Our Free EU General Data Protection Regulation – Compliance guide, gives an overview of the key areas of change introduced by the Regulation and the critical areas organisations need to be aware of when preparing for compliance.
The Business benefits of the GDPR
Watch our short video where Alan Calder, IT Governance Founder and Executive Chairman, answers the important questions surrounding the EU GDPR and how it affects businesses in the EU.
While the GDPR maybe complex and challenging there are business benefits to be gained from compliance:
- Build customer trust;
- Improve brand image and reputation;
- Improve data governance; and
- Improve information security
Who does the GDPR apply to?
- All EU organisations that collect, store or otherwise process the personal data of individuals residing in the EU, even if they’re not EU citizens.
- Organisations based outside the EU that offer goods or services to EU residents, monitor their behaviour, or process their personal data.
Find out how your organisation can start its journey to becoming GDPR-compliant today
The principal requirements
Click to expand some key changes introduced by the Regulation:
Find out more about the key changes introduced by the GDPR and how you can comply by downloading our free green paper
What is personal data?
Personal data is any information relating to an identified or identifiable natural person (data subject). The Regulation places much stronger controls on the processing of special categories of personal data (previously referred to as sensitive personal data) than the Irish Data Protection Act. The inclusion of genetic and biometric data is new to this category.
- Email address
- Identification number (including online identifiers and IP addresses)
- Location data
- Online behaviour (cookies)
- Profiling and analytics data
- One or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of a natural person.
Special categories of personal data
- Racial or ethnic origin
- Religious or philosophical beliefs
- Political opinions
- Trade union membership
- Sex life or sexual orientation
- The processing of biometric data
- Genetic data
How does Brexit affect the GDPR?
When the UK left the European Union on 31 January 2020, the Withdrawal Agreement commenced. This agreement ensures that the UK will be treated as an EU member state (subject to some exceptions) while the UK and the EU negotiate a trade deal.
This transition period is set to end on 31 December 2020. Until then, the GDPR (General Data Protection Regulation) will continue to apply as normal while the UK applies to become an adequate country. This is a detailed process that must be completed with the European Commission and can take a significant amount of time – the quickest EU adequacy decision to date, which pertained to Argentina, took 18 months.
The transition period may come to an end without the EU having made an adequacy decision in favour of the UK. Ireland’s DPC (Data Protection Commission) encourages controllers to plan their data transfer arrangements in the event that further negotiations result in some form of negotiated deal or a ‘no deal’ Brexit that changes the nature of data protection in the UK and its relationship with EU data protection law.
Further guidance from the DPC can be found here
How IT Governance can help you get GDPR-ready
IT Governance, a leading global provider of IT governance, risk management and compliance solutions, is at the forefront of helping organisations globally address the challenges of GDPR compliance.
Speak to a GDPR expert
If you’re looking for help with your GDPR project, get in touch with our experts who can advise you on which of our products and services are best suited to your needs.