Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.
EU’s General Data Protection Regulation Is Law: Now What?
Organizations have two years to prepare to act as borrowers, not owners, of customer data. Here are seven provisions of the new GPDR you ignore at your peril.
4 Min Read
It’s time for companies to face the music on data privacy. EU legislators signed data privacy regulations into law in April, and the clock is ticking for implementation in 2018. Before we entertain objections that the law places unreasonable demands on companies with EU citizens’ personal data, let’s remember that security and privacy are joined at the hip. You can’t ensure data privacy without adequate information security.
Moving forward without proper security only slows the progress companies push for. Consumers have lost faith in cybersecurity in digital commerce and online activity, according to a recent National Telecommunications and Information Administration (NTIA) survey. The General Data Protection Regulation (GDPR) will hold companies accountable for security controls they should already have in place. New regulations are not only necessary, they’re overdue.
Getting Acquainted with the GDPR
Organizations essentially have two years to prepare to act as data borrowers, not owners. When a company collects customer data, it is on loan. The customer can monitor its use, decide who accesses it, and demand its return. A company must have the ability to audit and control each of these processes in order to comply with the new law. One can imagine how difficult this will be for global enterprises with thousands of vendors and partners. The sooner organizations can start, the better. The new law comes into effect on May 25, 2018.
IT, security, and compliance practitioners must familiarize themselves with the requirements. Ambitious readers can find the 200-page law available online, or an in-depth guide. To get started, here are seven key provisions you should not ignore:
Fines With Teeth: In the past, regulators claim companies brushed fines off as mere "pocket money." Individual countries defined their own fines, further exacerbating the challenge to the regulation’s impact. The new law will raise the maximum fine to four percent of global revenue or €20M, whichever is higher.
Ringing the Data Breach Alarm: We’ve grown accustomed to data breach notifications coming months after the fact – or even years. Under the new law, companies will have 72 hours to report data loss to their regional authority. Reducing the timeline from months to hours will force companies to put in place defined policies on responding to data breaches. If you thought having a breach response plan in place was a given, think again: only 44.5% of companies have a complete plan, according to a Cloud Security Alliance survey.
Regulations Beyond Borders: This provision should grab the attention of any global companies who were exempt from the previous regulation because they were not headquartered in the EU. Now any organization with data on EU individuals must comply with the regulation, wherever they are based. Experts have already predicted the law will encompass "pretty much every website and app in the world."
Know Your Partners: Hackers have realized that the easiest path to a company’s sensitive data can be third-party contractors, from an HVAC vendor to a press release wire service. Under the new law, any company who touches regulated data must comply with the law, even if they are not the data collector. For companies who do not have a full list of vendors and business partners, taking inventory and evaluating risk will be an essential undertaking.
No Running from the Law: Companies can transfer data outside the EU, including to cloud providers with servers based in other countries. The company does not hand off responsibility and still remains liable for any lost data.
One Law for One Continent: Up until now, enforcement on data privacy infractions has been inconsistent even among European countries, with certain countries taking tougher stances than others. The GDPR will standardize all countries under the same strict law, so there will be no surprises for companies based on the region of enforcement.
Encryption as a Saving Grace: Encryption is a powerful tool for reducing risk in the event of data loss, and the GDPR recognizes this capability. Encrypting data exempts a company from its breach notification responsibility. Rather than encrypt all customer data, companies should encrypt fields containing regulated data. Doing so before data leaves the company network can also provide a method of reducing third-party risk, especially from cloud providers.
Companies collect more information on customers than ever as business moves online and data collection happens so seamlessly that companies can lose sight of the responsibility that comes with storing sensitive information. The GDPR codifies the belief that "the protection of natural persons in relation to the processing of personal data is a fundamental right…" Rather than fight the regulation, companies should embrace the new requirements as a means of establishing trust with customers and ultimately accelerating digital commerce.
Related content:
About the Author
You May Also Like
More Insights
