Why GDPR is so important !
Rafik Gerges - MSc Cybersecurity, ML Diploma, CISSP, CEH
Sr. Global Blackbelt for Data Risk Management - Central & Eastern Europe, Middle East and Africa
After four years of preparation and debate the GDPR was finally approved by the EU Parliament on 14 April 2016. It will enter in force 20 days after its publication in the EU Official Journal and will be directly application in all members states two years after this date. Enforcement date: 25 May 2018 - at which time those organizations in non-compliance will face heavy fines.
But why is it so important?!!
The EU General Data Protection Regulation (GDPR) replaces the Data Protection Directive 95/46/EC and was designed to harmonize data privacy laws across Europe, to protect and empower all EU citizens data privacy and to reshape the way organizations across the region approach data privacy.
The GDPR applies broadly, to organizations of all sizes and types, including large and small businesses and public authorities. The GDPR also has broad territorial application and could apply to your organization even if you are processing personal data outside of the EU or are processing personal data of non-EU residents. Specifically, the GDPR applies to:
1- The processing of anyone’s personal data where that processing is done in the context of the activities of an organization established in the EU (regardless of where the processing actually takes place).
2- The processing of personal data of individuals in the EU by an organization established outside the EU, where that processing relates to the offering of goods or services to those individuals or to the monitoring of their behavior.
Infringements as per Article(83) of the directive can be subject to administrative fines up to 20,000,000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher.
The GDPR is a complex regulation that may require significant changes in how organizations collect, process, and manage data. Accordingly, both controller and processor companies will have to comply before the deadline, else faces a terrible future !
TBC.
Article by Rafik Gerges.