GDPR

The General Data Protection Regulation is a fully re-written and updated data protection law for the European Union. It was created to simplify the current disparate laws across the EU that handle data privacy into a single regulation. This supports the EU’s digital single market strategy and strengthens the rights of individual citizens to control how their data is used.

GDPR focuses on how companies process personal data – meaning how companies use, store, collect and transfer personal data of an individual “in the EU” must comply with the law – not just EU citizens or businesses located in the EU.

Personal data covers any information related to an identified or identifiable individual (also called a “data subject”). Personal data includes any type of identifiable information, including gender, phone number, email address, mailing address, and online habits.

The GDPR provides expanded rights to individuals in the EU and increases the obligations on organizations. Some of the key changes are: Rights: The GDPR provides enhanced rights for individuals in the EU including portability, restriction, and deletion of personal data. Accountability: To comply with GDPR, organizations must implement appropriate policies, conduct privacy impact assessments, keep detailed records on data activities and enter into written agreements with suppliers to protect personal data. Profiling and monitoring: Organizations that profile or monitor behavior of individuals in the EU have additional obligations under GDPR. Security: Organizations must have technical and organizational measures to secure personal data, including measures such as pseudonymization and anonymization. Data breach notification: The GDPR requires organizations to report certain data breaches to data protection authorities, and under certain circumstances, to the affected data subjects. Enforcement: Authorities can fine organizations up to the great of €20 million or 4% of a companies annual global revenue, based on the seriousness of the breach and damages incurred. One stop shop: The GDPR introduces the concept of a lead supervisory authority to allow organizations operating in many EU countries to work with one data protection authority rather than many for matters such as cross-border data protection issues and enforcement.

No, under GDPR, EU personal data does not have to stay in the EU. It does not place any new restrictions on transferring of personal data outside the EU.