Will the GDPR affect your business?
Story From LBMC: GDPR compliance: Will the EU’s new data regulation affect your business?
Prepare for major changes in personal data sharing. The new regulation begins May 25.
GDPR compliance: Will the EU’s new data regulation affect your business?
The European Union’s General Data Protection Regulation (GDPR) goes into effect on May 25, and it’s going to have a bigger impact on U.S. organizations than you might think.
The GDPR replaces the EU’s former directive for protecting online personal data and will regulate data protection policies for residents of EU member nations and businesses across the globe who offer services and products to EU residents.
Penalties for violations are steep, so you will want to be prepared. But many organizations don’t know if the GDPR applies to them and, even worse, are unsure how to find out. You might be wondering, “Does the GDPR apply to my company?” If so, here are four questions you should ask.
Is my organization established in the EU?
If your organization is physically operating anywhere in the EU, then yes, the GDPR does apply to you, and you must abide by its requirements. Some organizations may be operating in a “shell” within the EU but might not truly be offering services there. These circumstances vary and should be discussed with a privacy professional to determine applicability of the GDPR to your organization.
Is my organization a controller or processor under GDPR (or both)?
Article 4 of the GDPR identifies the different roles and responsibilities of controllers and processors for organizations who harbor personal data.
As it can sometimes be difficult for organizations to determine which of these roles (if not both) best describes them, an information security partner can be helpful in making a clear distinction. Organizations must know their role to comply with their specific GDPR responsibilities.
Does my organization offer services to people who live in the EU?
“Offering” means specifically targeting customers in the EU.
“Selling” means you are not targeting EU residents, but, if an EU resident wants to purchase your product or service, you will still sell to them.
If you are offering to EU residents, you are responsible for adhering to the GDPR. However, if you are simply selling to EU residents, the GDPR may not be applicable to your organization.
If you are selling to EU residents, the applicability of GDPR to your organization depends on how much business you are doing there. If EU residents are a very small percentage of your revenue, you are more likely to fall out of the GDPR’s scope. However, if a significant part of your company’s revenue comes from EU residents, you are more likely to fall under the GDPR’s scope.
You may not feel like you’re offering or selling services to EU citizens. Some organizations are simply ingesting lots of data for analytical and technical research or other reasons. If this data contains information from EU citizens, the GDPR may apply. GDPR would also likely apply to you if you are processing information for an EU company.
Are you monitoring activity or behavior within the EU?
If your company provides an app, for example, that includes any level of monitoring, and you have users residing or even visiting the EU, you are in scope of the GDPR. Even if an app is only available in the U.S. but you track users while they are in the EU, you likely need to comply with the GDPR.
Map out the entire data flow of your organization and take inventory. Classify all data according to type, if you have not already. You will need to locate all network locations storing or transmitting personal data.
Once you have determined where this data resides, it is time to implement policies, procedures, technical measures and processes to allow your organization to comply with any of the regulations of the GDPR.
While the GDPR presents new challenges for organizations storing or processing personal data, compliance is possible, especially with the right guidance. For more information, download an LBMC Information Security webinar or contact a data privacy professional, who can analyze and classify your organization’s data to determine GDPR applicability. Whether the GDPR applies to your organization or not, after working with an expert, you will know for certain.
Caryn Woolley is a director of quality assurance & professional development for LBMC Information Security, a leading Tennessee-based IT security firm. Reach her at 615-309-2478 or cwoolley@lbmc.com.