GDPR Defined

The General Data Protection Regulation (GDPR) is a data privacy and security law that was passed by the European Union back in 2018. It quickly made its reputation as one of the toughest laws for its scope and also for its enforcement. We’ve had some questions regarding GDPR lately so we thought this would be a great time for an introduction, as well as a refresher to companies that may have scrambled to put a plan together in 2018 and haven’t thought about it since.

What does GDPR Cover?

GDPR was implemented to protect the personal data of citizens in the European Union. This means that this law applies to not only businesses in the EU, but any business that has personal data on someone living in the EU. For example, if you sell goods or services to someone who lives in the EU, you are processing data protected by GDPR. Since separating this data from regular customer data can prove to be difficult, many businesses have chosen to adopt a new, GDPR-friendly practice and apply it to all of their data processing practices.

Consent is a major component of this law, requiring consent requests to be presented in a clear manner and the response of consent to be “freely given, specific, informed and unambiguous.” This means clearly asking permission to collect customer data, and you must store documentary evidence of this data for future reference. At any point, a customer may withdraw consent, asking you to delete any record of their personal data.

There are also specific instances stated in which its appropriate to process citizen data. These instances include:

1. A clear opt-in to a newsletter or marketing list, such as registration on a form
2. Data processing is necessary to create a contract, such as a subscription to a service
3. A legal obligation requires it, such as a court order
4. Data processing is required to save someone’s life, such as an unlikely hostage situation
5. You need this data to perform a task in public interest, such as collecting recycling
6. You have a “legitimate interest,” such as investigating fraud or a threat to public security

If you are sure you are allowed to process a citizen’s data, you are responsible for doing so in accordance with GDPR’s outlines that state:

1. Your processing must be transparent to the data subject and lawful (meeting above requirements).
2. You may only use the data as expressed to the citizen.
3. You should only process as much data as is necessary
4. Your data must be kept accurate and up to date
5. You may only keep the data for as long as expressed, or needed for its intended purpose
6. You must process data in a way that ensures security and confidentiality
7. You must demonstrate compliance to GDPR in all manners

Finally, data must be processed securely! This section is a little vague, but it boils down to “appropriate technical and organizational measures.” Your organization should already be focused on security and data protection, so complying with this step shouldn’t prove to be too difficult. This could include practices such as regular risk assessments, employee trainings, appropriate data encryption, etc.