General Data Protection Regulation
General Data Protection Regulation
In May 2018, a new European privacy law called the General Data Protection Regulation (GDPR) came into effect. It regulates the processing of personal data relating to individuals in the European Union (EU), regardless of where the processing takes place. The Regulation lays down general rules to protect natural persons’ personal data and to ensure the free movement of personal data within the EU. It imposes new obligations and stricter requirements on all businesses that process personal data from EU citizens to establish a new right for individuals. Any processing of personal data should be lawful, fair, and transparent. Natural persons must be informed when their personal data are collected, used, and consulted, and to what extent they will be processed.
GDPR Influence on Business
If you are processing or holding the personal name, social security number (or any other personal identification number), address, phone number, email, location, or online identifier of an EU citizen, the GDPR applies to you. It does not matter where the processing takes place or where the company's location is. Find out how much your company complies with GDPR to avoid an administrative fine ranging from 20 million euros to 4% of its annual global revenue in case it doesn’t.
GDPR Key Requirements
GDPR applies to all companies and entities processing the personal data of people residing in the EU, regardless of the company’s location or the location of data processing
Consent & New Rights:
An individual’s consent to the processing of their data must be specific and clearly given. Data subjects have the right to data portability, data erasure, and consent withdrawal at any given time
Breach notification within 72 hours:
Duty to report the personal data breach to the supervisory authority within 72 hours of becoming aware of the breach
Privacy By Design:
Legal requirement to embed data protection and privacy issues into processing activities and business practices
Data Protection Impact Assessment (DPIA):
Duty of a company or entity to undertake DPIA when conducting risky or large-scale processing of personal data
Data Protection Officer (DPO):
DPO must be appointed if a company or entity conducts large-scale systematic monitoring or processes large amounts of sensitive personal data
: A company or entity is accountable for processing personal data according to the GDPR and has to be able to prove it
Cross-border data transfer:
Restrictions on the transfer of personal data outside the EU unless certain conditions are met
Our Service Area
itialuS helps your company comply with GDPR
We offer a full range of customized services to suit an organization’s specific needs at any stage of the GDPR readiness procedure:
Reviewing current data collection, data processing, and transit practices, then identifying gaps and areas of risks across people, processes, and technologies used.
Data Privacy Impact Assessment
Assessing risk for specific areas, systems, and projects for client organizations that are legally required to undergo Data Privacy Impact Assessment
Designing, developing, and implementing processes and tools to address all of the company’s GDPR audit and compliance requirements related to the individual’s information.
Assessing cybersecurity posture and recommendations for the implementation of policy, processes and technologies that establish the appropriate level of security to mitigate risks
Data Breach Plan and Action
Developing and implementing notification plans for incident responses and data breaches.
Education and Training
Tailor-made training for staff on the importance of GDPR, its impact and compliance requirements, as well as their obligations and responsibilities.
Data Protection Officers (DPOs)
Assisting in monitoring internal compliance, informing and advising on the client’s data protection obligations and data protection impact assessments (DPIAs). DPOs act as a contact point for data subjects and supervisory authorities. They do not have to be employees of controllers or processors but can be external service providers. They provide all the help needed to stay compliant with the GDPR.
Representing companies that are not based in the EU regarding their obligations under the GDPR