What is GDPR (General Data Protection Regulation)?
It is a personal data privacy and security law devised by the European Union (EU). The details run into hundreds of pages and apply to all companies that collect data from EU residents. It does not matter where such a company is located in the world. If it collects data from the people of the EU, it must comply with the GDPR laws.
The regulation came into effect on 25 May 2018. Companies that fail to comply with these regulations face penalties and other legal consequences. The GDPR laws are the toughest in the world when it comes to the privacy and security of personal data.
The following information is a brief guide and should not be taken as legal advice. Consult a lawyer specializing in data privacy to comply with your business operations with the GDPR.
GDPR Meaning
The GDPR rules were devised after the earlier data protection laws were found ineffective in the changing tech scenario. This law has been devised to protect the “data subjects” – the individuals whose private data is processed. The GDPR tries to maintain a fine balance between the data rights of an individual and the requirements of companies to gather such data.
Some Important Terms Used in the GDPR:
Data Subject – Any person whose personal data is stored or processed.
Personal Data – Personally identifiable data like name, email address, gender, and others.
Data Processing – All manual and automatic methods used to process the data of an individual.
Data Controller – The authority of an organization that decides how to process data collected from the users.
Data Clarity – Users must receive clear communication in an easy-to-understand language about data processing.
Informed Consent – A person must first receive clear information about the data controller and the reason for data processing before giving consent.
Data Erasure – A person’s right to be forgotten.
Request Form – Data subjects have a right to access their personal data for any rectification in it.
GDPR Data Subject Rights
The main aim of the GDPR is to give people control over their personal data. They, and not the other party demanding and storing their data, decide how their data should be processed. Some of the GDPR rights of the data subject include:
1. Data Subject Rights Request – Data subjects have a right to access their information.
2. Rectification Right – The right of data subjects to fix their inaccurate data.
3. Data Processing Restriction – The right to process data according to the restrictions and limitations set by them.
4. Data Erasure – The right to be forgotten and erase personal data stored with an entity.
5. Clear Information – Data subjects must be provided information in a simple language they can understand.
6. Data Portability – The data subjects should be able to port data according to their specifications.
7. Objection Right – A person can object to the way their personal data is processed.
8. No Automated Data Processing without Consent – Any decision regarding a user’s data should not be taken based only on an automated process.
The Seven GDPR Principles include
1. Companies must use transparent, fair, and legal ways to process the data of their users.
2. They must declare the specific reason for collecting the data. This data cannot be used for any other purpose without getting new or updated consent.
3. It is their responsibility to collect only the data necessary for the purpose for which it is being collected.
4. They have to ensure the data collected and held by them remains accurate at all times. Any inaccurate data must be rectified or discarded as soon as possible.
5. Data controllers cannot store the data of their users longer than necessary. The user must have been informed how long their data will be used. Any change in this duration should be made only after getting the user’s consent.
6. It is the responsibility of the data controllers to take appropriate technical and other measures to protect the data of their users. They must have effective systems in place to prevent loss, damage, destruction, or unlawful use of the personal data of their users.
7. The data controller is responsible for complying with all GDPR rules and regulations. A company must identify in its organization the authority responsible for ensuring GDPR compliance.
What Are the Consequences of Not Complying with the GDPR Requirements?
Minor infractions can result in small to large administrative fines. The data protection supervisory authority of the government has the right to impose administrative fines on the data controllers not complying with the GDPR regulations. This authority will assess the gravity, duration, and nature of the infringement, and see if the error was deliberate or unintentional. The authority will also take into account whether sufficient preventative systems had been put in place as mandated under the GDPR.
The GDPR infringement penalty can be €20 million or 4% of the global business turnover in the preceding financial year, whichever is higher.
