Companies are unprepared for the GDPR
The European General Data Protection Regulation (GDPR) will have a global impact when it goes into effect on 25th May, 2018, according to Gartner, Inc. Gartner predicts that by the end of 2018, more than 50 per cent of companies affected by the GDPR will not be in full compliance with its requirements.
“The GDPR will affect not only EU-based organisations, but many data controllers and processors outside the EU as well,” said Bart Willemsen, research director at Gartner. “Threats of hefty fines, as well as the increasingly empowered position of individual data subjects tilt the business case for compliance and should cause decision makers to re-evaluate measures to safely process personal data.
The GDPR replaces the Data Protection Directive 95/46/EC and is designed to support the single market, to harmonise data privacy laws across Europe, to protect and empower European Union (EU) citizens’ data privacy and reshape the way organisations approach data privacy for EU citizens wherever they work in the world.
Gartner recommends organisations act now to ensure they are in compliance when the regulation goes into effect. They should focus on five high-priority changes to help them to get up to speed with GDPR requirements.
1. Determine your role under the GDPR Any organisation that decides on why and how personal data is processed is essentially a “data controller.” The GDPR applies therefore to not only businesses in the European Union, but also to all organisations outside the EU processing personal data for the offering of goods and services to the EU, or monitoring the behaviour of data subjects within the EU. These organisations should appoint a representative to act as a contact point for the data protection authority (DPA) and data subjects.
2. Appoint a data protection officer Many organisations are required to appoint a data protection officer (DPO). This is especially important when the organisation is a public body, is processing operations requiring regular and systematic monitoring, or has large-scale processing activities. “Large scale” does not necessarily mean hundreds of thousands of data subjects.
3. Demonstrate accountability in all processing activities Very few organisations have identified every single process where personal data is involved.
