Beginning Of The GDPR Regime

On 25th of May, 2018, the global IT Industry entered a new age of regulations and compliance with EU GDPR which is being touted to have a huge impact on the market and individual businesses. This virtually changes the playing field, with a need to rethink how enterprises treat their data as arguably intense 4 percent penalties and a damaging blow to the brand image is the last thing any business needs.

As per Wikipedia, the General Data Protection Regulation (GDPR) is a regulation in EU law on data protection and privacy for all individuals within the European Union and the European Economic Area. It also addresses the export of personal data outside the EU and EEA. The GDPR aims primarily to give control to citizens and residents over their personal data and to simplify the regulatory environment for international business by unifying the regulation within the EU.

Superseding the Data Protection Directive, the regulation contains provisions and requirements pertaining to the processing of personally identifiable information of data subjects inside the European Union. Business processes that handle personal data must be built with privacy by design and by default, meaning that personal data must be stored using pseudonymization or full anonymity and use the highest-possible privacy settings by default, ensuring that the data is not available publicly without explicit consent, and cannot be used to identify a subject without additional information stored separately. No personal data may be processed unless it is done under a lawful basis specified by the regulation, or if the data controller or processor has received explicit, opt-in consent from the data’s owner. The business must allow this permission to be withdrawn at any time.