Back to Blog
What isGDPR?
What is GDPR and why is it relevant for your business? Learn about GDPR, personal data, and GDPR fines here!
What is GDPR?
RELATED CONTENT
Continue Reading
Explore more privacy compliance insights and best practices
What is GDPR and why is it relevant for your business? Learn about GDPR, personal data, and GDPR fines here!
Explore more privacy compliance insights and best practices
When it came into force back in 2018, it was the most significant change in data protection for decades since the ePrivacy Directive and the most comprehensive law worldwide addressing online privacy issues.
It imposes significant duties to businesses to protect users’ personal data. That includes a number of obligations for the collection, processing, use, and transfer of data, as well as implementation of data security measures. Most importantly, it requires businesses to not track users without obtaining their explicit consent.
In addition to that, the GDPR grants users with rights in relation to their own personal data that every business has to respect.
Any company that does business in Europe and/or with European citizens needs to be GDPR compliant.
Non-compliance with the GDPR leads to the biggest monetary fines ever prescribed by a data protection law.
Although ISO 27001 and GDPR are fundamentally different frameworks, but they share a lot of common principles in relation to data protection. Read about ISO 27001 Data Protection .
Before GDPR, data protection laws were outdated and inconsistent among EU member states. The GDPR has replaced those inconsistencies with a regulation obligatory for all member-states of the EU.
As a result, the laws among the EU countries are unified. If you comply with the GDPR, it means that you are compliant with the national data protection laws of every single EU country.
Personal data is any information related to a natural person that can be identified or is identifiable by that information, directly or indirectly.
This means that:
Examples of personal data include name, surname, email addresses such as name.surname@company.com, a home address, ID card number, cookie ID, Internet Protocol (IP).
Examples of data not considered personal data include a company registration number, email addresses such as info@company.com, and anonymized data.
Both CCPA and GDPR are data protection laws, but the requirements of each of them tend to be quite different.
While there are some similarities, most notably in relation to transparency and data subject rights, the two laws differ a lot. Therefore, if you are compliant with the CCPA it won’t make you compliant with the GDPR and vice versa.
If both the CCPA and the GDPR apply to your business, you have to make sure to determine what each of them require from your business and act accordingly to comply.
A GDPR privacy policy is a document with which the business informs the user about their privacy practices. Although not explicitly required by the GDPR, the privacy policy is the most common way of being transparent to the users about your use of their data.
A GDPR-compliant privacy policy should contain certain elements to be compliant. These elements include:
This is just the necessary minimum of information that the GDPR requires you to provide. You can add more if you want. Read more about how you can make your website GDPR compliant.
Website users and app users are called data subjects in the GDPR. The GDPR grants them data subject rights. These rights empower users to protect their data privacy against the business that has their data collected. Learn the 6 Steps for Website Compliance.
The data subject rights include the right to:
Every EU business owes these rights to all their users. All non-EU businesses owe these rights to all their EU users.
Users can exercise their rights by submitting data subject requests, including DSAR requests. Upon verifying the user identity, you have to comply with their request and fulfill it.
Secure Privacy provides businesses with a DSAR center for seamless compliance with data subject requests.
Learn more about Data Subject Access Request Procedure.
GDPR prescribes the world’s largest penalties related to data protection. Read more about GDPR fines and enforcements in our blog post.
Read all about GDPR data transfer in our blog post.
Data transfer is the process where personal data flows from one company to another, or from the user to the company. When that’s a transfer across international borders, that is an international data transfer.
Read all about transferring data outside the EU in this blog post.
GDPR requires only some of the businesses to appoint a Data Protection Officer (DPO).
You must appoint a DPO if you are a business whose core activities involve:
Public authorities are also required to appoint a DPO in any case.
In all other cases, you are not obliged to appoint a DPO.
A DPO can be the business owner, any employee, an independent contractor, or an organization to whom you outsource the processes. See some common problems GDPR DPOs face.
You need a legal representative in the EU if:
In all other cases, you do not need to appoint a legal representative in the EU.
A data breach occurs when the data for which your company/organization is responsible suffers a security incident resulting in a breach of confidentiality, availability, or integrity.
In most cases, you need to inform the relevant data protection authority. You have to notify them in 72 hours upon becoming aware of the incident, or later if there are reasonable reasons for the delay.
If the breach poses a risk to the rights and freedoms of the data subjects whose data has been breached, you have to notify the data subjects as well.
In some rare cases, where the breach is insignificant and poses no risk to anyone whatsoever, you may not have to inform anyone.
If your company/organization is a data processor it must notify every data breach to the data controller.
