On May 25th 2018, the new GDPR (General Data Protection Regulation) becomes law across the EU, not just for companies operating within those countries, but for all companies which deal with EU countries, regardless of their location across the world.

GDPR builds on the existing Data Protection Directive of 1998, with new key principles which give the individual stronger rights to know how their data is being controlled and to instruct the company controlling their data to delete, modify, or cease to use. Companies will therefore have a much more significant duty of care over individuals’ data, and failures to comply will result in significant penalties. Just some of the possible breaches could be:

• Failure to adequately protect personal identifiable data, in-situ or when transferred.

• Failure to notify breaches within 72 Hours to the Supervisory Authority

• Failure to gain or demonstrate consent to use of personal data.

• Not providing an individual access to their data within the required timeframe.

• Failure to delete, rectify, or cease to use data upon an individual’s request. Also, the individual will have rights over the portability of their data to a different controller.

Penalties for non-compliance will be significant, ranging up to €20 Million or 4% of total revenue, whichever is the greater.