All you need to know about GDPR and how it affects the management of personal data. Here are the answers to some of the questions you may be asking about the 2018 European General Data Protection Regulation.
Who does the GDPR really apply to?
This regulation applies mainly to all companies established in Europe. However, all companies outside Europe that also process data from European people are affected by this mandatory compliance.
What type of data is concerned? What is meant by personal data?
Personal data is any information held about a person: name, first name, sex, religion and so on. Any company is in possession of such data, whether about its internal staff or, especially, about its customers.
Optimal traceability of this information must be demonstrated and correctly described in order to reassure each party.
What can I do if I collect data from my website?
First of all, it is important to know that only businesses are concerned by the GDPR. Individuals are not affected and therefore do not need this seamless traceability for the management of personal data.
When collecting data from a website, visitors must be made aware of the intended use of their information and agree with the owner of the website. The company will then have to document the data tracking and guarantee that no fraudulent use has been made of it.
What is a Data Protection Officer (DPO)?
This is a position to fill in the companies concerned by the GDPR. This person is the chief of data protection compliance within the organisation. He or she should ensure that all processes are properly followed and that staff have been properly trained in all the relevant guidelines.
For SMEs, a full-time DPO may not be possible and would not necessarily be consistent given the size of the company. This is why they can call on an external DPO, mandated to perform this control mission.
Is there a label to ensure that I comply with the GDPR?
There is currently no official label that guarantees that an organisation is 100% compliant. Random internal checks may occur within your company. In addition, competent authorities can audit your company and provide you with a complete report on the current status and opportunities for improvement.
What should be done in case of data loss or a GDPR offence?
It is necessary to notify the competent authority as soon as possible, and at the latest within 72 hours. The authority will then analyse your response to this loss of data and put in place solutions to avoid a recurrence in the future.
What are the penalties for GDPR non-compliance?
The GDPR represents a huge workload for the companies involved. The maximum penalties can be up to 4% of global turnover or 20 million euros.