General Data Protection Regulation ((EU) 2016/679)

On 25 May 2018, the GDPR will become directly applicable in all EU member states and, despite Brexit negotiations, the UK Government has confirmed that it will be implementing these new rules in full. Designed to be more future-proof than its predecessor, the Data Protection Directive, the GDPR aims to maintain its relevance in an environment where technology is constantly changing. With the limit on fines for breach of the GDPR increasing, from £500,000 under the current regime, to the greater of €20 million or 4% of worldwide turnover, it is important that organisations start preparing now to ensure compliance next May.

The GDPR applies to any organisation which controls or processes personal data, such as the financial details, employment details, medical details and other personal information relating to an individual. It adopts a very broad definition of “processing” this personal data meaning that almost any activity an organisation is involved in relating to personal data is likely to fall within the GDPR’s scope.

Organisations which are compliant with the current regime are at a good starting point to ensure compliance with the GDPR. However, there are a number of key changes which organisations need to be aware of to avoid the severe sanctions above. Some of these key changes to the data protection regime include:

• Expanded territorial scope
• Increased enforcement powers
• Higher standard of consent required for processing information
• Direct compliance obligations for data processors
• Strict rules relating to notification of breaches
• Introduction of pseudonymisation (ie the processing of personal data in such a manner that the data cannot be attributed to an individual without additional information)
• Right to erasure, also referred to as the “right to be forgotten”
• New timescale for responses to data subject access requests

If you would like more information please get in touch and we will ensure that you are able to speak with one of our data protection specialists.