A simple Google search on GDPR requirements and GDPR checklists will result in lots of information and free resources. The sheer amount of information available is dizzying to say the least and with any new regulation, lots of myths begin to emerge. The tasks of verifying the accuracy of the advice given is another concern. To understand and interpret the regulation takes time and good old-fashioned research. Hopefully my background in regulatory compliance and risk management will help you figure out the woods from the trees. Let’s go through important GDPR points now.
The General Data Protection Regulation is a European law which will act as the primary law regulating how companies protect European Union (EU) citizens’ personal data. The law was passed by the European Parliament in April 2016 and becomes effective May 25, 2018.
Regulatory fines will vary based on a tiered approach on the severity of the violation. Firms may be fined up to 4% of global revenue or 20 million euros. The European law will have a global reach and is increasingly becoming a regular topic with U.S. based firms who either operate in Europe or export European data outside of the EU.
The law itself is broken down into 11 chapters. These contain the following headers so the regulation itself becomes manageable or at least the reader can navigate through the requirements. Within each chapter are several articles. There are 99 articles in total which go into the granular level detail a compliance professional would expect to flesh out the regulation.
With GDPR, you as the data controller need to understand your data processor’s, aka your third party’s, data protection and information security protocols. The institution is responsible for any mishaps that happen at a third party who houses your consumer’s sensitive information such as Non-Public Personal Information (NPPI). Your data security is at risk here if you are not thoroughly doing your due diligence.
Chapter 1 - General Provisions: The regulation outlines the requirement of data privacy protection to natural EU citizens with the processing of personal data and aims to manage the movement and storage of this data within or outside of the EU – if any of your clients are EU citizens, this regulation affects you.
Chapter 2 - Principles: Data collection should be processed lawfully and transparently with the individual being able to freely give consent for the purpose of which the collection was intended. Data controllers, aka you as the institution, are encouraged to only collect pertinent information with a focus on data minimization.
Chapter 3 - Rights of the Data Subject (Individual): The controller must communicate with the individual relating to data processing in a clear concise and transparent manner. This must be in clear and plain language and should be provided to the individual in writing either in mail or electronic means. Should the individual speak directly with the controller, the information may be provided verbally provided that the individual has been able to prove their identity. As an institution, you need to make sure you’re aware of your vendor’s customer procedures for things like this should they come into contact with your clients in this way.
While the compliance clock is ticking down quickly with the “go live” date of May 25, 2018 for GDPR compliance, check into our blog for Part 2 – we’ll will cover additional chapters of this new regulation aimed at protecting the individual’s personal information.
In the meantime, make sure your policy and program documents are up to date to include GDPR. Download our Vendor Management Umbrella infographic series.