The General Data Protection Regulation is the European Union’s regulations concerning personal data protection. The EU enacted the law on April 26, 2016, and it becomes enforceable on May 25, 2018. Multinational companies need to adjust to these regulations to avoid compliance issues and to continue doing business in the EU.
How Does GDPR Apply to US Businesses?
U.S.-based companies fall under the GDPR when they handle EU citizen data as part of their business operations. One of the main goals of this revamped regulation is to ensure that foreign companies offer the EU the same data protection that its domestic companies do.
The good news is that the GDPR standardizes data protection regulations for all EU countries, so U.S.-based companies only need to make a single set of changes, rather than altering their processes for each EU member.
GDPR Requirements
Organizations have a lot of flexibility in the way they follow GDPR requirements, since there is significant room for interpretation in the way it’s currently written. Companies have to take reasonable measures to ensure the protections of personal data from EU citizens; however, the requirements don’t offer a definition of what “reasonable” means in this context.
U.S.-based companies also need to remember that the GDPR has a long list of data considered personal information. These companies may be familiar with protecting basic data such as names, addresses and driver’s license or ID information, but the GDPR also includes biometrics, genetics, web, health, sexual orientation, ethnic, political and racial data.
Out of that list, web data may be the one that companies have the most trouble with. IP addresses, cookies and similar pieces of information often play a big role in marketing campaigns. Companies may not have solutions in place to protect the privacy of this information and may require a complete overhaul of their campaigns.
EU citizens must also consent to the personal data collection before companies can ask for this information. Should they decide they no longer want the business to have the information, the organization must delete it upon request.
If a company falls victim to a data breach, it has 72 hours to report it under GDPR. Both responsible authorities and the individuals whose data was stolen must receive this information.
GDPR Noncompliance Penalties
The EU has several ways to sanction companies if they don’t meet the GDPR requirements by the deadline. The most financially damaging is a fine of up to 20 million euros or 4 percent of that enterprise’s annual turnover. Written warnings or audits cover circumstances where the company did not intend the noncompliant activity.
Getting Assistance With Your GDPR Strategy
U.S.-based companies have a lot to take in but not a lot of time to implement changes. Multinational enterprises may need assistance with rolling out these personal data changes so they can operate in the EU without receiving fines that could total millions of euros.
An IT company well-versed in GDPR requirements can create a custom strategy that fits in with the enterprise’s needs and goals for its EU operations. Businesses avoid noncompliance issues due to not understanding any part of this law or failing to meet the unclear definition of “reasonable” measures. This type of external partner is the perfect choice for a short-term project that only needs maintenance moving forward.
Sources:
https://www.csoonline.com/article/3202771/data-protection/general-data-protection-regulation-gdpr-requirements-deadlines-and-facts.html
https://en.wikipedia.org/wiki/General_Data_Protection_Regulation
