New general data protection regulation gdpr

The General Data Protection Regulation (GDPR) is a European Union (EU) regulation that aims to protect the personal data of individuals within the EU. It was adopted in 2016 and came into effect on May 25, 2018. The GDPR replaces the Data Protection Directive 95/46/EC and is designed to harmonize data protection laws across the EU.

Key principles of the GDPR:

  1. Transparency: Data controllers must be transparent about how they process personal data.
  2. Consent: Individuals must give explicit consent for their personal data to be processed.
  3. Purpose limitation: Personal data can only be processed for specific, legitimate purposes.
  4. Data minimization: Only the minimum amount of personal data necessary for the purpose should be processed.
  5. Accuracy: Personal data must be accurate and up-to-date.
  6. Storage limitation: Personal data should not be stored for longer than necessary.
  7. Integrity and confidentiality: Personal data must be protected from unauthorized access, alteration, disclosure, or destruction.
  8. Accountability: Data controllers must be accountable for the processing of personal data.

Rights of individuals under the GDPR:

  1. Right to be informed: Individuals have the right to be informed about the processing of their personal data.
  2. Right of access: Individuals have the right to access their personal data.
  3. Right to rectification: Individuals have the right to rectify their personal data if it is inaccurate or incomplete.
  4. Right to erasure: Individuals have the right to erasure of their personal data (also known as the "right to be forgotten").
  5. Right to restriction of processing: Individuals have the right to restrict the processing of their personal data.
  6. Right to data portability: Individuals have the right to receive their personal data in a structured, commonly used, and machine-readable format.
  7. Right to object: Individuals have the right to object to the processing of their personal data.

Roles and responsibilities under the GDPR:

  1. Data controller: The entity that determines the purposes and means of processing personal data.
  2. Data processor: The entity that processes personal data on behalf of the data controller.
  3. Data protection officer (DPO): A designated individual responsible for ensuring compliance with the GDPR.

Penalties for non-compliance:

  1. Administrative fines: Up to €20 million or 4% of the company's global annual turnover, whichever is greater.
  2. Other penalties: Other penalties may include warnings, reprimands, or even criminal prosecution.

Key changes and updates:

  1. Breach notification: Data controllers must notify the relevant supervisory authority of a personal data breach within 72 hours.
  2. Data protection by design and default: Data controllers must implement data protection by design and default in their processing activities.
  3. Data protection impact assessment: Data controllers must conduct a data protection impact assessment (DPIA) when processing personal data that involves a high risk to individuals.
  4. Certification and labeling: Data controllers can obtain certification or labeling for their data processing activities.

Overall, the GDPR aims to strengthen data protection and provide individuals with more control over their personal data.