Personal data protection and GDPR – rules for organizations
Personal data protection has risen to be one of the most important tasks for every company that handles fragile client data on a daily basis. Recent years and many breaches in security systems have shown that keeping up with the highest data protection standards has not been the easiest task for many.
As a result, the need of creating new rules and regulations was born. They need to be more strict, more demanding, more protective. The General Data Protection Regulation (GDPR) comes into life in 2018 and to ensure that your company complies to all the standards, you’ll need to get certified. What are the major rules that need to be followed?
What GDPR actually is?
Being the most important change in data privacy regulation in 20 years, GDPR is a regulation issued by the European Commission, the European Parliament and the Council of Ministers of the European Union. The goal of the GDPR is to improve data protection for individuals within the European Union. With this particular regulation, the EU aims to give back the control over how the personal data is used to its citizens. They also want to provide businesses with a clearer legal structure with which to operate by standardising across the EU – it is easy to maintain these informations using dedicated software – more about this you can learn here – visit ins2outs cases.
What are the main rules of GDPR?
One of the main changes that will take place with the GDPR is the extended jurisdiction of the regulation. Previously, only companies which had their physical offices located within the EU had to comply to the Data Protection Directive. With the GDPR, any company collecting and processing EU citizen’s personal data must comply to the rules, regardless of the location of company’s physical offices.
Companies will also be obliged to obtain individual’s consent to store and use their data as well as explain how it would be used. This rule has been in use for many years, but now it is obligatory that companies do that, no exceptions. Organisations will also be required to notify their supervisory authority about any security breach within 72 hours of discovering it.
Companies will also have to provide electronic copies of private records to those individuals that will want to know what data is being processed, where it is stored and for what purpose. Also, the EU citizens will have the right to request all their data to be permanently deleted from company’s files and not to be shared with third parties.
