GDPR for Dummies by Privado

What Is GDPR?

GDPR or General Data Protection Regulations were introduced by the European Union back in 2018.  There has been a lot of data theft in European countries in the last couple of years. According to statista.com, there have been over 50,000 data breaches in the European Union countries within 2019 and 2020. European policymakers came up with the concept of GDPR to prevent such rampant data breaches. GDPR now requires businesses to provide significant data protection to prevent data theft.

How Is Personal Data Defined In GDPR?

Information related to personal data is written in the 4th article of the regulation of GDPR. Personal data refers to any information that can be used to identify a human being. 

Examples of such personal data include name, phone number, credit card data, address, anything that can be used to gain information about a person. 

However, some data is classified as “special category data,” mentioned in the 9th article. Such information includes sensitive information that can be used to discriminate against a person. This information includes ethnic origin, religious belief, political view, health data, etc.

Both articles 4 and 9 of the GDPR regard this type of data as personal data.  An individual’s data must be safeguarded to protect the person from identity theft and other cybercrimes. 

Who Is GDPR Meant For?

Anyone living in the European Union is subject to the GDPR. This means all individuals and all companies inside the EU are a part of GDPR, and they must follow the regulations posed by GDPR to prevent any data leaks. GDPR obligations apply to those businesses that deal with this type of sensitive information.

For example, a company that works with personal information puts that person at some risk of exposure to potential harm if their data was stolen. A data theft will leak all information about that individual. If your company is something like this, then you must follow all the obligations of GDPR. 

But suppose your company does not deal with the personal information of any individual or any other entity. In that case, some regulations of GDPR can be avoided as they do not apply to you.

What Is The Role Of Data Processors And Data Controllers

Data controllers and data processors are the two roles that help protect the data and prevent it from being stolen. Although the two roles might sound similar, they are entirely two separate functions.

1. The Role Of Data Processors

Data Processors need to have a contract with a Data controller for them to function. Through this pre-arranged contract, they can process the data controlled by Data Controllers. Data processors also ensure the safety of the data and emphasize the rights of the data subject.

2. The Role Of Data Controllers

Data Controllers are the ones who decide which data need to be processed. Hence they are the ones who determine the processing activities. 

To be a rightful Data controller, you must follow Section 6(2) of the Data Protection Act 2018. A controller can be an individual or a company or even a self-employed professional as long as they follow Section 6(2)

Who Does Not Need To Use GDPR?

As mentioned before, certain businesses are exempt from GDPR obligations if they do not use any personal information of users to conduct business.

Apart from that, a few other organizations and companies are not obligated to follow the rules of GDPR. For example, if any organization or company falls out of the European Union, that company does not need to follow GDPR.

Detective and law agencies are also not inclined to follow GDPR. They use personal data specifically for identification and investigation. So if they were to follow GDPR, identifying criminals would be very difficult.

Which Areas Does GDPR Apply To?

GDPR applies to any country or jurisdiction under the European Union. 

Germany, Netherlands, Austria, Ireland, Italy, Latvia, Bulgaria, Croatia, Spain, Sweden, and all other countries that are a part of the European Union need to follow GDPR.

Businesses that operate outside of these areas are not affected by GDPR.

What Are The Penalties Of GDPR Non-Compliance?

If you are a part of the EU, you must follow GDPR. But you cannot just make regulations and expect everyone to use them. The best way to ensure that organizations follow GDPR is by creating some penalties for not following GDPR. Such GDPR penalties include-

• A fine of 10 million EURO if they fail to protect data or 2% of the company’s revenue of the preceding fiscal year, depending on which is higher in value
  

If the regulation violation is severe, then the fine can increase to 20 million euro or 4% of the company’s global revenue of the preceding fiscal year, whichever is higher in value.

What Are GDPR’s Core Principles?

There are 7 fundamental principles that GDPR follows. It is through these core principles that they apply to data protection. These principles ensure that all the data are processed lawfully and with no illegal data breach. These seven core principles include-

1. All Personal Data Must Be processed lawfully processed, and the process must be transparent

2. The Company Must be specific about the reason why they are collecting personal data of the client

3. Collect the absolute minimum data necessary to operate.

4. Have accurate and up-to-date data about the clients and individuals

5. Do not store data that has already been used. After the purpose of the data collection is done, delete that data.

6. The company must apply sufficient protection methods to safeguard personal data.

7. The company must be held accountable should anything happen to the data.

Final Words

Because of a large number of data breaches in Europe, something had to be done. Thankfully, the EU policymakers came up with an effective method of data protection at the right time, GDPR.