Glossary

General Data Protection Regulation (GDPR)

The General Data Protection Regulation represents the European Union’s efforts to create one set of data privacy laws that regulate all member states. It required member states to adopt the regulations by May 25, 2018. Some countries made minor changes, but overall, it replaced the Data Protection Directive of 1995.

The GDPR determines how organizations can collect, process, and retain personal data. It also gave some control to EU residents regarding what companies can do with their data, such as whether they can sell it to third parties. When companies fail to comply, the GDPR can take enforcement action which can total billions of dollars in damages.

What Prompted the Creation of the GDPR?

The issue of data privacy existed long before the internet. Even so, the internet created a new platform and vehicle for data to exchange hands. It also provided a treasure trove that companies exploited to market their products and ideologies to people, even when those things might prove harmful.

Things came to a head after the 2016 Presidential Election as agencies investigated the role Facebook and other social media companies played in allegedly spreading misinformation. This further compelled other countries to consider the potential effect social media and the internet could have on their electoral processes.

Here are some additional factors that prompted the creation of the GDPR:

  • The need to update the EU’s data protection framework in light of advances in technology and changes in the way personal data is collected, processed, and stored
  • The growth of cross-border data flows and the global nature of the internet
  • The recognition that data protection is a fundamental right under the EU’s Charter of Fundamental Rights
  • The need to provide individuals with greater control over their data
  • The desire to create a level playing field for companies operating in the EU by harmonizing data protection rules across the bloc
  • The need to ensure that EU data protection rules are applied consistently

Who Does the GDPR Regulate?

The GDPR applies to any organization that handles the personal data of individuals in the European Union. Generally, it does not matter whether the organization has headquarters inside or outside of the EU. Consequently, even foreign entities serving EU residents must comply with the rules. 

Here are some common examples of companies that might have personal data:

  • Banks and friendly societies
  • Insurance providers
  • Data mining websites
  • Marketing agencies
  • Social media apps

Personal data includes any information that someone can use to identify an individual. This data includes, but is not limited to, an individual’s name, address, date of birth, and IP address.

What Are the GDPR’s Key Requirements?

The GDPR establishes several critical requirements for organizations that process personal data. These requirements include:

  • Obtaining explicit consent from individuals before collecting, processing, or storing their data.
  • Providing individuals with clear and concise information about how the organization will use their data.
  • Limiting the collection and use of personal data to what is necessary for the intended purpose
  • Securing personal data using appropriate technical and organizational measures.
  • Erasing or destroying personal data when no longer needed and subject to regular monitoring.

Organizations that process personal data must also ensure that data is accurate and up-to-date. They must also provide individuals with a way to access their data and exercise their rights under the GDPR.

What Are the GDPR’s Enforcement Mechanisms?

The GDPR establishes several enforcement mechanisms to ensure data controllers comply with its requirements. Fines can reach up to 4% of a company’s global revenue. The violations committed determine where the fines fall in that range. Here are some of the most well-known fines that have made headlines over the years:

The GDPR also gives individuals the right to file a complaint with the supervisory authority if they believe companies have violated their rights. This further returns control to consumers.

What Role Does Message Capturing and Archiving Play in GDPR Compliance?

The GDPR made it possible for individuals to request to “be forgotten” by businesses, apps, and websites. Companies can only comply with this request if they properly archive and store the information about specific customers.

Archiving solutions make it easy to retain and later search for specific data. It also makes it possible to delete that data and comply with requests. In the event of an investigation, message archiving can also show proof of compliance and internal communications.

Are you ready to make it easier for your business to comply with the GDPR and subsequent data privacy requests? Get your LeapXpert demo today.