The difficulty of answering these questions, as well as other complicated areas, makes GDPR compliance an area where action needs to be taken as quickly as possible for U.S. companies. In the event of a data breach, your company must report the event to the relevant data protection authority within 72 hours of becoming aware of the event. The General Data Protection Regulation (GDPR) is an EU data protection law that regulates the collection and use of individuals` personal data within the European Union. The GDPR requires websites to first obtain and obtain explicit consent from their visitors before being allowed to collect and process their personal data. The text of the GDPR is quite broad and it can be difficult to ensure compliance. For companies that need to comply with the GDPR, here are the most important requirements and functions: The GDPR requires the controller and processor to appoint a DPO to oversee data security strategy and GDPR compliance. Companies must have a DPO if they process or store large amounts of EU citizens` data, process or store special personal data, regularly monitor data subjects or are a public authority. Certain public entities, such as law enforcement agencies, may be exempt from the DPO requirement. [Related: –>GDPR requirements increase global data protection deployments] So if you have a website in the US and you have visitors from the EU, the GDPR applies to your domain. Therefore, if this is the case, you must comply with the requirements and conditions of the GDPR for data processing. The GDPR does not apply: in this scenario, the company and its customers are located outside the EU/EEA, and the processing and storage of data also takes place outside the EU/EEA.

Therefore, this gym does not have to comply with the GDPR. In the event that a US company is expected to comply with the GDPR, it is subject to the same strict requirements that EU-based companies are required to meet. If you`re a U.S.-based company or a multinational, you may have noticed that over the past few months, you`ve seen a significant increase in the number of vendor (or other) contracts you need to change or verification forms you`ve been asked to run. If you haven`t already, you probably will. The reason for this upward trend is simple: the European Union`s (EU) General Data Protection Regulation (GDPR) comes into force on May 25, 2018, and the companies you work with must be GDPR compliant, which imposes obligations on you. The scope of the GDPR If you have nothing to do with the EU, so no physical presence in the EU, no employees, not nothing, you`re probably wondering why the GDPR affects you in the first place. The answer to this question depends on the scope of the GDPR, including its application to U.S.-based businesses and what it means for those companies. While the GDPR has been the most significant privacy and security change in Europe in over 20 years, and that`s certainly true, it`s also the most significant change in privacy security in the U.S. since HIPAA (as it has impacted the healthcare industry), because many US-based companies will fall within the scope of the GDPR in one way or another. The GDPR extends to U.S.-based companies, as the GDPR aims to protect the “personal data” of individuals. Notwithstanding what you may have read in other sources, the GDPR does not say “residents” of the EU or “citizens” of the EU, it states that it applies to the processing of “personal data of data subjects”, controllers and processors located in the EU, but also to “processing activities” related to: (1) the offering of goods or services; or (2) monitor the behaviour of data subjects in the EU. See Article 3(2) GDPR.

The GDPR replaces the 1995 EU Data Protection Directive, which generally did not regulate companies based outside the EU. Even if a US-based company does not have employees or offices within the borders of the EU, the GDPR may still apply. The European Parliament adopted the GDPR in April 2016, replacing an outdated 1995 data protection directive. It contains provisions that oblige companies to protect the personal data and privacy of EU citizens for transactions that take place in EU Member States. The GDPR also regulates the export of personal data outside the EU. Any organization, private and public, that stores or processes personal data about EU citizens must comply with the GDPR, even if it does not have a physical presence within the EU. The most important requirements are explained below. The GDPR leaves a lot to interpretation.

It states that, for example, companies must provide an “adequate” level of protection for personal data, but does not define what is considered “adequate”. This gives the GDPR`s governing body a lot of leeway when it comes to assessing fines for data breaches and non-compliance. The second step is to enter into contracts between the controller and the processor to ensure that their contracts meet all the legal specifications of the GDPR. The GDPR describes a number of contractual requirements between controllers and processors, including: identification of the purpose and duration of the processing; identification of the nature and purpose of the processing; structure the obligations and rights of the controller; act only on the written instructions of the controller; ensure that those who process the data do so under a written confidentiality agreement; Assist the controller in meeting breach reporting requirements. Unlike U.S. breach notification laws, which leave more time to notify individuals and relevant authorities of a data breach, the GDPR requires notification to be made within 72 hours of a breach. There are many things to grasp and think about when it comes to GDPR. It is a law that we have been reviewing, analyzing and working with for almost two years. The hardest thing about GDPR is changing your perspective and realizing that it probably has some applicability to your business.

Amend your lexicon to include words such as “controller”, “processor” and “data subject”; and learn how to break down the GDPR into its manageable chunks so that compliance is no longer overwhelming and piece by piece. .