General Data Protection Regulation (GDPR): What You Need To Know To Stay Compliant

Table of Contents

Businesses that collect data from citizens in European Union (EU) countries must adhere to strict new rules designed to protect consumer data. The General Data Protection Regulation (GDPR) sets a new standard for data privacy and consumer rights. However, companies will face challenges as they implement systems and processes to stay compliant.

Compliance with the GDPR may raise concerns and introduce new expectations for security teams. For example, the GDPR expands the definition of personal identification information to include things like an individual's IP address or cookie data, requiring the same level of protection as more traditional personal information such as name, address, or Social Security number.

While the GDPR provides guidelines, there is significant room for interpretation. It states that businesses must offer a “reasonable” level of protection for personal data, but what qualifies as “reasonable” is not clearly defined. This ambiguity grants the GDPR governing body considerable flexibility in deciding penalties for data breaches or non-compliance.

With the deadline fast approaching, it is crucial for businesses to understand the key aspects of the GDPR and follow the advice for meeting its requirements. Although many aspects of the regulation do not directly relate to information security, the changes required to comply could impact current security systems and protocols.

What is the GDPR?

Adopted by the European Parliament in April 2016, the GDPR replaces the outdated 1995 data protection directive. It requires businesses to protect the privacy and personal data of EU citizens during transactions within EU member states and when personal data is transferred outside the EU.

The regulations are consistent across all 28 EU member states, providing businesses with a single standard to meet within the EU. However, this standard is quite stringent and will require significant investment from most companies to comply and manage.

Why Was the GDPR Introduced?

The primary reason for the GDPR is the growing public concern over privacy. Europe has long maintained stricter rules on how businesses use personal data. The previous Data Protection Directive, enacted in 1995, did not account for the digital transformation that would occur in the following decades. As a result, the previous directive became outdated, failing to address current methods of data collection, storage, and transfer.

The concern about privacy is real and increasing with each high-profile data breach. According to the RSA Data Privacy & Security Report, 80% of consumers in France, Germany, Italy, the UK, and the U.S. expressed concern about the loss of banking and financial data. Additionally, 76% were worried about lost security information, such as passwords, and identity data like passports or driving licenses.

An alarming finding for companies handling consumer data is that 62% of respondents in the RSA report said they would hold the company responsible for a data breach rather than the hacker. The report concludes that as consumers become more aware, they expect businesses to be more transparent and responsive in managing their data.

Consumer Behavior and Trust

A lack of trust in how companies handle personal information has prompted some consumers to take matters into their own hands. The RSA report showed that 41% of respondents intentionally falsified data when signing up for services online. Concerns about security, unwanted marketing, and the potential resale of their data were among the main reasons for this behavior.

The report also revealed that consumers are unlikely to forgive companies after a data breach. In the U.S., 72% of respondents said they would boycott a company that seemed to neglect data protection. Furthermore, 50% of global respondents indicated that they would be more likely to shop at a company that can demonstrate a commitment to data protection.

The Impact of Digital Transformation

As businesses increasingly rely on digital assets, services, and big data, they must be accountable for monitoring and securing that data every day. The RSA report emphasizes that businesses must prioritize data protection to maintain consumer trust and ensure compliance with regulations like the GDPR.

What Data is Covered by the GDPR?

The GDPR protects a wide range of personal data, including:

Basic identity information (e.g., name, address, and ID numbers)
Web data (e.g., IP address, location, cookie data, and RFID tags)
Health and genetic data
Biometric data
Racial or ethnic data
Political opinions
Sexual orientation

Which Businesses are Affected by the GDPR?

The GDPR applies to any company that collects or processes personal data of EU citizens, even if the company is not located in the EU. Companies that meet one or more of the following criteria must comply with the GDPR:

Having a physical presence in an EU country
Processing personal data of EU residents without a physical presence in the EU
Employing more than 250 people
Employing fewer than 250 people but processing data that impacts data subjects' rights or involves sensitive personal data

According to a PwC survey, 92% of U.S. companies consider GDPR a priority for data protection.

A survey by Propeller Insights, sponsored by Netsparker Ltd., found that the GDPR would most affect industries such as technology (53%), online retail (45%), and software (44%).

Who is Responsible for Compliance?

The GDPR defines three key roles that companies must manage:

Data Controller – The entity that determines how personal data is processed and for what purposes.
Data Processor – The entity responsible for processing personal data on behalf of the data controller. Data processors are also liable for any breaches or non-compliance.
Data Protection Officer (DPO) – An appointed individual responsible for overseeing data protection strategies and ensuring GDPR compliance.

Companies that process large amounts of EU citizen data, handle sensitive personal data or are public authorities are required to have a DPO. A Propeller Insights survey revealed that 82% of companies already have a DPO, and 77% plan to hire a new or replacement DPO before the GDPR deadline.

What About Third-Party Contracts?

The GDPR holds both data controllers and processors equally accountable for data breaches. If a third-party processor is non-compliant, the company is also considered non-compliant. Organizations must ensure that all third-party vendors (e.g., cloud providers, SaaS vendors, or payroll services) comply with GDPR regulations, especially regarding data protection and breach reporting.

Existing contracts with third parties must outline responsibilities, including data protection protocols, breach reporting, and other obligations. These contracts must also address how personal data is handled and protected.

The Importance of Updating Contracts

Many companies are working on updating their contracts with vendors to ensure compliance with the GDPR. This includes understanding how personal data is stored, processed, and exported and ensuring third parties maintain strong data protection practices.

Contract updates are essential for clearly defining responsibilities, especially regarding breach notification processes. If a vendor is hacked, the company should know who to contact and how to respond. Contracts should specify how breaches are reported within the required 72-hour window and how the organization will handle the breach.

Failure to finalize contracts by the GDPR deadline can lead to operational challenges, vendor management issues, and potential regulatory fines. Companies that lack contracts will have difficulty demonstrating their awareness of data flows and understanding of their data protection processes.

The Risks of Non-Compliance

If contracts are not finalized before the GDPR deadline, companies risk:

Operational Challenges – Unclear processes for managing data and complying with GDPR regulations.
Vendor Management Issues – Not knowing how third-party vendors handle security and data processing increases the risk of non-compliance.
Regulatory Fines – The EU is known for imposing steep fines for GDPR non-compliance. Lack of contracts may indicate poor management of data and vendor relationships, leading to penalties.

As the May deadline approaches, businesses must take immediate action to ensure their processes, data flows, and third-party contracts are fully compliant with GDPR requirements to avoid operational and legal risks.