GDPR
General Data Protection Regulation
GDPR – General Data Protection Regulation
The General Data Protection Regulation (GDPR) is an EU regulation by which the European Parliament, the Council of the European Union and the European Commission intend to strengthen and unify data protection for all individuals within the European Union (EU).
What is GDPR?
The General Data Protection Regulation 2016/679(GDPR) will replace the actual Directive (Data Protection Directive). GDPR is focused on the protection of data subjects. It will be enforceable from May 25, 2018. Organisations are encouraged to start preparing now, taking into account that some obligations may be onerous and time consuming to implement.
Both administrative fines and legal proceedings can be placed against organisations found to be in violation of the regulations. Regulatory bodies across the EU have been given the power to enforce greater financial penalties than ever before. These fines are a maximum of € 20,000,000 or 4% of the total worldwide turnover for the parent company in the previous financial year, whichever is the greater value. The only way to minimize a fine is to show your steps towards compliance. From the outset be aware the GDPR is not just an IT problem.
Does my organisation need to be GDPR compliant?
If you store, collect, process or transmit data you’re in scope and have to comply with the GDPR. The GDPR applies to processing carried out by organisations operating within the EU. It also applies to organisations outside the EU that offer goods or services to individuals in the EU.
When processing any sensitive or personal data as either a data controller or processor you must take appropriate technical measures to secure data against accidental loss, damage or destruction and provide explicit consent for processing each service.
Article 5 of the GDPR requires that personal data shall be:
- processed lawfully, fairly and in a transparent manner in relation to individuals;
- collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;
- adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
- accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;
- kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed;
- processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.”
How can organisations prepare?
The adoption of internationally recognised management system standards such as ISO 27001: 2013 Information and Data Security demonstrate an organisations active vigilance and preparedness to firstly achieve compliance and thereafter maintain compliance with the GDPR.
How are GDPR and ISO 27001 related?
ISO 27001 is a framework for information protection. According to GDPR, personal data is critical information that all organisations need to protect. There are some GDPR requirements that are not directly covered in ISO 27001, such as supporting the rights of personal data subjects: the right to be informed, the right to have their data deleted, and data portability. But, if the implementation of ISO 27001 identifies personal data as an information security asset, much of the GDPR requirements will be covered.
Contact Us
For a free Quotation or On-Site presentation by an ISO Specialist, contact us today!
IMSM Ltd
Malaysia
Level 15, Dpulze
Lingkaran Cyber Point Timur,
Cyber 12, 63000,
Cyberjaya, Malaysia