What is GDPR?

The General Data Protection Regulation (GDPR) is a set of regulations that member states of the European Union must implement in order to protect the privacy of digital data. The regulation is also known as the EU Data Protection Regulation, Reg. No. 765/2016.

The General Data Protection Regulation is designed to give individuals more control over their personal data, and to make it easier for them to understand how companies use that data. It also requires companies to get explicit consent from individuals before collecting, using, or sharing their data.

The General Data Protection Regulation applies to any company that processes or intends to process the personal data of individuals in the EU, regardless of whether the company is based inside or outside of the EU. This includes companies that offer goods or services to individuals in the EU, or that collect and process data about EU citizens for other purposes.

The General Data Protection Regulation went into effect on May 25, 2018. At that time, companies that have not complied with the regulation may be subject to fines of up to 4% of their global annual revenue, or €20 million (whichever is greater).

What does GDPR mean for you?

If you are a company that processes the personal data of individuals in the EU, then you need to comply with GDPR. This includes ensuring that individuals have the right to access their data, the right to have their data erased, the right to object to its processing, and the right to data portability.

It also means that you need to get explicit consent from individuals before collecting, using, or sharing their data. And you need to be transparent about how you use that data.

If you are an individual in the EU, GDPR gives you more control over your personal data. You have the right to know what data is being collected about you, the right to have that data erased, the right to object to its processing, and the right to data portability.

You also have the right to know how your data will be used, and to give or withhold consent for its use.

What are the penalties for non-compliance with GDPR?

If you are a company that processes the personal data of individuals in the EU, and you do not comply with GDPR, you may be subject to fines of up to 4% of your global annual revenue, or €20 million (whichever is greater).

These fines can be imposed for a variety of offenses, including failing to get explicit consent from individuals before collecting, using, or sharing their data; failing to provide individuals with the right to access their data; and failing to take adequate measures to protect the personal data of individuals.

Why does your business need to be GDPR compliant?

If you do business in the European Union, you must comply with GDPR. This applies to any company that processes or intends to process the data of individuals in the EU, regardless of whether the company is based inside or outside the EU.

What are the benefits of GDPR compliance?

There are a number of benefits to complying with GDPR, including:

1. Avoiding fines and penalties for non-compliance.

2. Building trust and credibility with individuals by being transparent about how you use their data.

3. Demonstrating your commitment to protecting the privacy of individuals.

4. Gaining a competitive advantage over companies that do not comply with GDPR.

5. Enhancing your company's reputation.

6. Improving customer satisfaction and loyalty.

7. Creating a culture of privacy and security within your organization.

8. Reducing the risk of data breaches and cyberattacks.

9. Avoiding the negative publicity that can result from non-compliance.

What is GDPR compliance?

GDPR compliance is the process of ensuring that your company meets all of the requirements of the General Data Protection Regulation. This includes, but is not limited to, getting explicit consent from individuals before collecting, using, or sharing their data; providing individuals with the right to access their data; and taking adequate measures to protect the personal data of individuals.

What are the steps you need to take to comply with the General Data Protection Regulation?

There are a number of steps you need to take to comply with GDPR, including:

1. Assessing your data processing activities to determine which ones fall under GDPR.

2. Documenting your data processing activities.

3. Implementing technical and organizational measures to protect the personal data of individuals.

4. Getting explicit consent from individuals before collecting, using, or sharing their data.

5. Providing individuals with the right to access their data, the right to have their data erased, the right to object to its processing, and the right to data portability.

6. Keeping track of consents given by individuals.

7. Deleting personal data when it is no longer needed or if an individual withdraws consent.

8. Reporting data breaches to the relevant authorities within 72 hours.

9. Appointing a Data Protection Officer (DPO)

What is the difference between GDPR and the Data Protection Act?

The General Data Protection Regulation (GDPR) is a new EU law that came into effect on May 25, 2018. The GDPR replaces the 1995 EU Data Protection Directive. The GDPR sets out strict new rules about how personal data must be collected, used, and protected.

The Data Protection Act is a UK law that implements the 1995 EU Data Protection Directive. The Data Protection Act sets out rules about how personal data must be collected, used, and protected. The Data Protection Act will continue to apply in the UK after Brexit.

Glossary:

Personal Data:

Personal data is any information that relates to an identified or identifiable individual. This includes, but is not limited to, names, addresses, telephone numbers, email addresses, and financial information.

Personal Data Processing:

Personal data processing is any operation or set of operations that is performed on personal data or on sets of personal data.

Data protection officer:

A data protection officer is an individual who is responsible for overseeing data protection compliance within an organization.

Data subjects:

Data subjects are individuals whose personal data is being processed by an organization.

Data controller / Data controllers:

Data controllers are organizations that determine the purposes and means of processing personal data.

Consent:

Consent is an individual's explicit agreement to the processing of their personal data for a specific purpose.

Personal data protection:

Personal data protection is the process of safeguarding personal data from unauthorized access, use, or disclosure.

Customer data:

Customer data is any information that relates to an individual who is or has been a customer of a company. This includes, but is not limited to, names, addresses, telephone numbers, email addresses, and financial information.

Personal data breach:

A personal data breach is any unauthorized access, use, or disclosure of personal data. This can include, but is not limited to, accidental or intentional accessed, used, or disclosed of personal data.

Data collected / Data collection:

Data collected is any information that is gathered by an organization through its interactions with individuals. This can include, but is not limited to, names, addresses, telephone numbers, email addresses, and financial information.

Sensitive personal data:

Sensitive personal data is any information that could potentially lead to identity theft or fraud. This includes, but is not limited to, names, addresses, telephone numbers, email addresses, and financial information.

Data processor:

A data processor is an organization that processes personal data on behalf of a data controller.

Data protection impact assessment:

A data protection impact assessment is a tool used to assess the risks involved in processing personal data. It is used to identify and mitigate potential privacy and security risks.

Data minimization:

Data minimization is the practice of only collecting and retaining the minimum amount of personal data necessary to achieve the purpose for which it was collected.

Processes personal data:

Under the GDPR, all data controllers must appoint a Data Protection Officer (DPO), unless they are a public authority, an SME, or processing data in certain other circumstances. A DPO is responsible for overseeing data protection compliance within an organization and ensuring that individuals' rights are respected.

Data controllers must also carry out data protection impact assessments (DPIAs) when they are planning to carry out processing that is likely to result in a high risk to the rights and freedoms of individuals. DPIAs help organizations to identify and mitigate risks to data subjects.

Data protection law:

Data protection law is the body of law that governs the use of personal data. In the European Union, this includes the General Data Protection Regulation (GDPR).

Data flows:

Data flows are the movement of personal data from one organization to another. Data flows can be either internal or external.

Internal data flow:

An internal data flow is a transfer of personal data within an organization. This can include, but is not limited to, transfers between departments or divisions within an organization.

External data flow:

An external data flow is a transfer of personal data to an organization outside of the European Union. This can include, but is not limited to, transfers to service providers or business partners.

GDPR Compliance Training

Course Description:

According to the GDPR, all organizations that process the personal data of EU citizens must provide thorough and up-to-date training for all employees who handle this information. This requirement applies regardless of whether the organization is based inside or outside the EU.

Organizations that fail to provide adequate training for their employees may be subject to fines of up to 4% of their annual global turnover or €20 million (whichever is greater).

In order to comply with the GDPR, organizations must ensure that their employees are properly trained on the following topics:

– The types of personal data that are covered by the GDPR.

– The rights of individuals under the GDPR.

– The obligations of organizations under the GDPR.

– The consequences of failing to comply with the GDPR.

Organizations should provide this training to all employees who handle personal data, including but not limited to, system administrators, database administrators, and customer service representatives. In addition, all new hires should be trained on these topics as part of their onboarding process.

Organizations may also want to consider providing GDPR compliance training to other individuals within the company who are not directly involved in handling personal data, but who could potentially come into contact with it. For example, executives and managers who have access to employee files or customer databases.

This course will provide you with the knowledge and skills necessary to ensure your organisation is compliant with the General Data Protection Regulation (GDPR).

The course covers the following topics:

-An overview of the GDPR and its key provisions

-Organisational requirements for GDPR compliance

-Data controllers and data processors

-Personal data

-Rights of data subjects

-Data breaches

-Enforcement of the GDPR

On completion of this course, you will be able to:

-Understand the requirements of the GDPR

-Identify your organisation's obligations under the GDPR

-Determine what personal data you process and how it is collected and used

-Understand the rights of data subjects under the GDPR

-Know how to deal with data breaches in compliance with the GDPR

-Ensure your organisation has appropriate measures in place to comply with the GDPR.