What does GDPR - mean for you
What is the GDPR?
The GDPR (General Data Protection Regulation) is a pan-European data protection law, which superseded the EU’s 1995 Data Protection Directive, and all member state law based on that directive, on 25 May 2018.
Significant and wide-reaching in scope, the GDPR brings a 21st-century approach to data protection. It expands the rights of individuals to control how their personal data is collected and processed, and places a range of new obligations on organisations (both controllers and processors) to be more accountable for data protection.
The GDPR also gives member states limited opportunities to make provisions or derogations for how the Regulation applies in their country; Ireland has done so via its Data Protection Act 2018, which came into effect on 25 May 2018.
GDPR – an ongoing compliance journey
25 May 2018 was just the beginning – the GDPR requires clear evidence of an organisation’s ongoing commitment and compliance efforts. You must ensure that you maintain your data processing practices to adequately address any emerging privacy and security risks.
If you have not yet started your GDPR journey, you should prioritise tackling those areas where a lack of action leaves your organisation exposed. When an infringement occurs, demonstrating you have made a start could help reduce potential penalties.
Who does the GDPR apply to?
- All EU organisations that collect, store or otherwise process the personal data of individuals residing in the EU, even if they are not EU citizens.
- Organisations based outside the EU that offer goods or services to EU residents, monitor their behaviour, or process their personal data.
Find out how your organisation can start its journey to becoming GDPR-compliant today
What are the GDPR requirements?
- Accountability and governance
- The six data processing principles
- Lawful processing
- Data subjects’ rights
- Valid consent
- Data protection by design and by default
- Transparency and privacy notices
- Data transfers outside the EU
- Mandatory data breach notification
- DPOs (data protection officers)
You must be able to demonstrate compliance with the GDPR. This includes:
- Establishing a governance structure with roles and responsibilities.
- Keeping a detailed record of all data processing operations.
- Documenting data protection policies and procedures.
- Carrying out DPIAs (data protection impact assessments) for high-risk processing operations. Learn more about DPIAs .
- Implementing appropriate measures to secure personal data.
- Conducting staff awareness training.
- Where required, appointing a data protection officer.
What is personal data?
Personal data is any information relating to an identified or identifiable natural person (data subject). The Regulation places much stronger controls on the processing of special categories of personal data (previously referred to as sensitive personal data) than the Irish Data Protection Act 2018. The inclusion of genetic and biometric data is new to this category.
Personal data
- Name
- Address
- Email address
- Photo
- IP address
- Location data
- Online behaviour (cookies)
- Profiling and analytics data
Special categories of personal data
- Race
- Religion
- Political opinions
- Trade union membership
- Sexual orientation
- Health information
- Biometric data
- Genetic data
