General Data Protection Regulation (GDPR)

Key Terms

1. Data Subject is a natural person who can be directly or indirectly identified, in particular by reference to a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
2. Personal Data means any information (objective and/or subjective) relating to an identified or identifiable natural person (“data subject”); such as information relating to their private, professional, or public life, including a name, email address, photos, bank statements, online identifiers etc.
3. Processing means anything done to personal data, whether or not by automated means. It involves any automated or manual operation or set of operations performed on personal data or sets of personal data, including the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval or accessing or viewing, consultation, use, analyzing, combining, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, deletion or destruction and so on. 
4. Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes, lawful basis and means of the processing of personal data;
5. Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
6. Consent refers to any “freely given, specific, informed and unambiguous indication” that the data subject agrees to the processing of personal data related to them. Data subjects can provide consent with either a statement or explicit affirmative action.
7. Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;
8. Pseudonymous Data is personal data that cannot be tied to a specific data subject without additional information that is stored separately, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;
9. Anonymous Data is data that cannot ever be connected to an identified or identifiable person.

The GDPR has broad reach, including extra-territorial reach. The GDPR applies to organizations (data controllers and data processors) that handle the PI of data subjects in the EU, whether the organizations are EU-based or not. The GDPR applies to organizations that are based in the EU, even if the PI is being stored or used outside of the EU, and to organizations that are not in the EU if:

1. the organization offers goods or services to individuals in the EU; or
2. the organization monitors their online behavior.

To decide whether we are covered under the GDPR, we need to consider both the ‘territorial scope’ and the ‘material scope’.

Learn more about ‘territorial scope’ and the ‘material scope →

There are seven key principles under the GDPR that provide guidance on how Personal Information must be handled by data controllers and data processors. The GDPR requires implementation of appropriate technical and organizational measures to implement these data protection principles effectively to safeguard data subject rights:

Lawfulness, fairness, and transparency

Processing must be lawful, fair, and transparent to the data subject. There should be a lawful basis for each processing activity. The data processing is not in a way that is unexpected, and the data subject is informed of the processing.

Purpose limitation

Personal Information may be processed for the legitimate purposes specified to the data subject when it was collected. Be clear about your purposes for processing and record and specify them in the privacy notice to individuals. Limit the processing to those identified purposes.

Data minimization

Personal Information should only be collected and processed to the extent as necessary for the specified purposes.

Accuracy

Personal Information must be accurate and up to date. Ensure the personal data that you processed is accurate and up to date. Correct or erase inaccurate personal data as soon as possible.

Storage limitation

Personal Information may be stored only for as long as necessary for the specified purpose. Only keep personal Information if you need it.

Integrity and confidentiality

Processing must be done in such a way as to ensure appropriate security, integrity, and confidentiality. Have appropriate security measures in place to protect the personal data from unauthorized or unlawful processing and accidental loss, destruction, or damage.

Accountability

The data controller and data processor must take responsibility for what they do with personal data and have appropriate measures and records in place to demonstrate their compliance with the data processing principles.

Learn more about GDPR Principles →

1. The purpose for Data Processing: GDPR requires that there must be a least one of the following legal purposes before personal data of data subjects can be processed: Consent, Contract, Legal obligation, Vital interests, Public interest, Legitimate interests
2. Compliance Obligations: Both, data controllers and also data processors are responsible for demonstrating compliance not just to the regulator; also to data subjects if necessary.
3. Breach Notifications: Data Controllers must report any data breach to the appropriate data protection authority as soon as possible and not later than 72 hours after becoming aware of the breach. Data subjects should be informed immediately of any breach that will cause high harm to them.
4. Privacy by Design: Companies must follow Privacy by Design principles and implement appropriate technical and organizational measures in an effective way to meet the requirements of the GDPR and protect the rights of data subjects.
5. Data Privacy Impact Assessment (DPIA): There is an obligation to perform a Data Privacy Impact Assessment (DPIA) when data processing may use “new technologies” or is risky, so that potential privacy issues can be identified before they arise, giving time to come up with a way to mitigate them before the project is underway.
6. Profiling: Restrictions are placed on automated processing of personal data with the purpose of evaluating/analyzing data subject, because of the impact it may have on the data subject which can include job denial, refusal of credit application, etc.
7. Data Subject Rights: The “right of portability” and the “right to be forgotten” are two new privacy rights granted to individuals under the GDPR. The right of portability affords residents easier access to their own data. Upon request, individuals will be able to transfer all data from one provider of goods or services to another; this provision was created to foster healthy competition and increase accountability among providers. Under the “right to be forgotten,” individuals can have their personal data erased upon request in certain circumstances.
8. One-Stop Shop: The GDPR’s new “one-stop-shop” provision, under which organizations with offices in multiple EU countries will have a “lead supervisory authority” to act as a central point of enforcement so they don’t struggle with inconsistent directions from multiple supervisory authorities.
9. Appointment of a Data Protection/Privacy Officer: Based on the EU Commission’s writings on the topic, a DPO is required for any enterprise with over 250 employees or for any enterprise processing the personal data of over 5,000 data subjects in any 12-month period. It is recommended that any organization that regularly processes personal data on a large scale or monitors data subject’s personal data appoint a data protection officer who will ensure compliance with privacy laws.
10. Enforcement: Under the GDPR, organizations can be fined up to €20 million or 4% of a company’s annual global revenue, based on the seriousness of the breach and damages incurred.

Learn more about Key changes in GDPR →

The GDPR outlines eight fundamental data subject rights, plus the right to withdraw consent:

Right to be informed: Data subjects have the right to be informed about the collection and use of their personal data.

Right to access: Data subjects have the right to view and request copies of their personal data.

Right to rectification: Data subjects have the right to request inaccurate or outdated personal information be updated or corrected.

Right to be forgotten / Right to erasure: Data subjects have the right to request their personal data be deleted. Note that this is not an absolute right and may be subject to exemptions based on certain laws.

Right for data portability: Data subjects have the right to ask for their data to be transferred to another controller or provided to them. The data must be provided in a machine-readable electronic format.

Right to restrict Processing: Data subjects have the right to request the restriction or suppression of their personal data.

Right to withdraw consent: Data subjects have the right to withdraw previously given consent to process their personal data.

Right to object: Data subjects have the right to object to the processing of their personal data.

Right to object to automated processing: Data subjects have the right to object to decisions being made with their data solely based on automated decision making or profiling.

Learn more about data subject rights →