The General Data Protection Regulation (GDPR) came into force on May 25, 2018, and has since completely transformed how companies must manage personal data from their customers, employees, and suppliers.
What is GDPR and why is it important?
GDPR is the European regulation that establishes rules relating to the protection of natural persons with regard to the processing of their personal data. It affects all companies that process data from European citizens, regardless of where the company is located.
Fundamental principles
GDPR is based on several key principles that every company must comply with:
- Lawfulness, fairness, and transparency: Data must be processed lawfully and transparently for the data subject.
- Purpose limitation: Data must be collected for specified, explicit, and legitimate purposes.
- Data minimization: Only data necessary for the intended purpose should be processed.
- Accuracy: Data must be accurate and kept up to date.
- Storage limitation: Data should not be kept longer than necessary.
- Integrity and confidentiality: Data must be processed securely.
Main obligations for companies
Records of processing activities
Every company that processes personal data must maintain a record of processing activities that includes:
- The purposes of processing
- Categories of data subjects and personal data
- Categories of recipients
- International transfers
- Retention periods
- Security measures applied
Data Protection Officer (DPO)
Some companies are required to appoint a Data Protection Officer:
- Public authorities or bodies
- Companies that carry out regular and systematic monitoring of data subjects on a large scale
- Companies that process special categories of data on a large scale
Important: Even if your company is not required to have a DPO, it is highly recommended to have an external advisor who supervises regulatory compliance.
Data Protection Impact Assessment (DPIA)
When data processing may pose a high risk to the rights of data subjects, it is mandatory to carry out a Data Protection Impact Assessment before starting the processing.
Penalties for non-compliance
GDPR penalties are significant and can reach:
- Up to 10 million euros or 2% of annual global turnover for less serious infringements.
- Up to 20 million euros or 4% of annual global turnover for more serious infringements.
Steps to comply with GDPR
- Initial audit: Identify all data processing you carry out.
- Legal basis: Ensure you have a legal basis for each processing activity.
- Documentation: Create all necessary documentation (privacy policy, records of activities, etc.).
- Security measures: Implement appropriate technical and organizational measures.
- Training: Train your staff on data protection.
- Continuous review: Keep your compliance system up to date.
Conclusion
GDPR compliance is not optional. Companies that fail to comply are exposed to multi-million euro fines and, worse, loss of customer trust.
If you need help adapting your company to GDPR, at Asesores&Datos we have a team of certified experts who can guide you through the entire process.