The General Data Protection Regulation, abbreviated as GDPR, was introduced on May 25, 2018. The regulation applies to every entity – big or small that has operations in the European Union in processing the data in an automated manner. This means that even if you are an Indian company having EU customers and process their data, then you will need to comply with this new data protection regulation.ย
What is Personal data?
The new regulation slightly changes the definition of personal data, as it also extends it to ID numbers, location information, property, and social status, as well as indicators relating to physical and mental health. What's more, even genetic and biometric data that could identify the chosen person will be considered personal data. This may lead to some kind of revolution in this field. Data owners will gain new permissions, and administrators will be forced to perform further duties. This means that it will be necessary to introduce numerous safety mechanisms on many levels, including administrative and technical.ย
The need for GDPR
Personal data leakage has become a routine phenomenon these days. Such data leaks is a threat to millions of individuals as their personal identity, financial details are made public. The new GDPR law may put an end to these crimes whether intentional or system failure. A heavy financial penalty may be a deterrence for large companies to strengthen their systems and processes in accordance with the law. Every aspect of data processing needs to be well-planned out without a room for any error.ย
In addition, the basis for their processing must be determined, which is connected with the preparation of an information clause for all persons whose data will be obtained. However, this is not all. The most important change concerns the purpose for which personal data is to be obtained. It should be legally justified. Data that are outdated or incorrect must be removed immediately. This provision may be problematic for entities that collect personal data for many years and have not yet verified them. Updating such a database will certainly take a lot of time, but it is obligatory.
The GPDR also involves setting the maximum time at which personal data will be stored. The base should enable achievement of the previously assumed goal, and when it is completed – it should be removed. Therefore, the data processors have a lot of responsibility because they will be obliged to verify them. They must also check whether the data is used for specific pre-defined purposes.
Legal consequences for non-compliance with the GDPR
Each entity that owns and manages a personal database must assess the risk of undesirable disclosure of personal data before taking any action. The changes also apply to the formal consent that must be given to the person whose data will be processed. In the beginning, all these changes may turn out to be a bit problematic, especially due to the amount of work and time spent on the database verification or its current update. Non-compliance with the regulation introduced soon will, however, be associated with legal consequences in the form of high financial penalties.
Ensuring an adequate level of data protection is a priority and should be treated as such. Thanks to GDPR, it is possible to effectively fight cybercrime and data leaks. It seems, therefore, that the changes introduced will have a positive effect on everyone.
