General Data Protection Regulation

By | 8th July 2019
0 Comment

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that the European Union adopted (EU) in 2016 and went into effect on May 25, 2018. It applies to any organisation that processes the personal data of individuals in the EU, regardless of the organisation’s location.

Here are some key points about the GDPR:

  1. It gives individuals more control over their personal data: Under the GDPR, individuals have the right to know what personal data is being collected about them, for what purpose it is being used, and who it is being shared with. They also have the right to request access to their personal data, to request that their personal data be rectified or erased, and to object to its processing.
  2. It imposes stricter rules on organisations that process personal data: The GDPR requires organisations to have a lawful basis for processing personal data, be transparent about how they use it, and secure it against unauthorised access or misuse.
  3. It establishes higher fines for non-compliance: The GDPR allows for fines of up to 4% of a company’s global annual revenue or £18 million (whichever is greater) for violations of the regulation.
  4. It applies to all types of personal data: The GDPR applies to any personal data that can be used to identify an individual, including names, addresses, IP addresses, and online identifiers such as cookie IDs.
  5. It applies to any organisation that processes personal data: The GDPR applies to any organisation that processes the personal data of individuals in the EU, regardless of the organisation’s location. This means that even if an organisation is based outside of the EU, it must comply with the GDPR if it processes the personal data of individuals in the EU.

Here are some key points about the General Data Protection Regulation (GDPR) in the context of IT infrastructure:

  1. IT infrastructure must be secure: The GDPR requires organisations to implement appropriate technical and organisational measures to protect personal data against unauthorised access, destruction, alteration, or unauthorised use. This includes measures such as encryption, secure servers, firewalls, and access controls.
  2. Personal data must be processed in a manner that ensures its security: The GDPR requires organisations to implement appropriate measures to ensure the security of personal data throughout its lifecycle, including when it is being transmitted, stored, or processed.
  3. Personal data must be deleted or anonymised when it is no longer needed: The GDPR requires organisations to delete or anonymise personal data when it is no longer necessary for the purpose for which it was collected.
  4. IT infrastructure must be able to facilitate individuals’ rights: The GDPR gives individuals certain rights about their data, including the right to access, rectify, erase, restrict, or object to the processing of their personal data. IT infrastructure must be able to facilitate the exercise of these rights.
  5. The GDPR imposes various obligations on organisations that process personal data, including the obligation to be transparent about how personal data is being used and to notify individuals and authorities in the event of a data breach.