The General Data Protection Regulation is a regulation in EU law whose legal use in the EU begins on May 25, 2018. This framework was designed to join data privacy laws across all EU members countries and it implies to all organizations which operate with data related to people in the EU. It is best practice with organizational, security, and technical measures to protect the privacy of persons through the protection of private data and information relating to those persons whose security, or any other right could be violated, in case of abuse of the same.
Private data in terms of GDPR means all data on the identity of a person, or data from which the identity of a person can be unambiguously determined, as well as data on political, sexual orientation, race, property status, but also data such as search history, metadata on files created by a certain person, which can reveal the identity, data on health, property status, movement, habits, and other personal data whose publication could endanger a person.
The GDPR applies only to personal data, which includes all unique identifiers, and provides the pseudonymization of data to avoid the possibility of misuse. The GDPR does not only apply to data and its handling, it also applies to business processes and those who process data. GDPR also provides transfer of obligations, namely, for organizations that outsource part of the work, they are responsible for those to whom they outsource part of the work.
Companies that process or track personal data must appoint a Data Protection Officer (DPO) at a very high level. The DPO is responsible for aligning the company’s work with the GDPR. In the case that the company does not comply with the rules, the legal consequences may include fines of up to 20 million euros or 4% of the annual turnover.
If you process data, you have to do so according to seven protection and accountability principles:
- Lawfulness, fairness, and transparency — processing must be lawful, fair, and transparent to the data subject.
- Purpose limitation — you must process data for the legitimate purposes specified explicitly to the data subject when you collect it.
- Data minimization — you should collect and process only as much data as necessary for the purposes specified.
- Accuracy — you must keep personal data accurate and up to date.
- Storage limitation — you may only store personally identified data for as long as necessary for the specified purpose.
- Integrity and confidentiality — processing must be done in such a way as to ensure appropriate security, integrity, and confidentiality.
- Accountability — the data controller is responsible for being able to show GDPR compliance with all these principles.
