• The regulation will take effect after a two-year transition period.

• Unlike a Directive, it does not require any enabling legislation to be passed by government, meaning it will be in force May 2018.

• If your activities are limited to the UK, then the position (after the initial exit period) is much less clear.

• The UK Government has indicated it will implement an equivalent or alternative legal mechanisms.

• Our expectation is that any such legislation will largely follow the GDPR, given the support previously provided to the GDPR by the ICO and UK Government as an effective privacy standard, together with the fact that the GDPR provides a clear baseline against which UK business can seek continued access to the EU digital market.

• Reference: http://www.lexology.com/library/detail.aspx?g=07a6d19f-19ae-4648-9f69-44ea289726a0

• This is the maximum fine that can be imposed for the most serious infringements e.g., not having sufficient customer consent to process data or violating the core of Privacy by Design concepts.

• There is a tiered approach to fines e.g., a company can be fined 2% for not having their records in order (article 28), not notifying the supervising authority and data subject about a breach or not conducting impact assessment.

• It is important to note that these rules apply to both controllers and processors, meaning "clouds" will not be exempt from GDPR enforcement.

• Consent must be clear and distinguishable from other matters and provided in an intelligible and easily accessible form, using clear and plain language.

• It must be as easy to withdraw consent as it is to give it.​

• Explicit consent is required only for processing sensitive personal data - in this context, nothing short of “opt in” will suffice.

• However, for non-sensitive data, "unambiguous" consent will suffice.

• It must be applied in its entirety across the EU, while a directive is a legislative act that sets out a goal that all EU countries must achieve.

• However, it is up to the individual countries to decide how.

• It is important to note that the GDPR is a regulation, in contrast to the previous legislation, which is a directive.

1. public authorities, or
2. organizations that engage in large scale systematic monitoring, or
3. organizations that engage in large scale processing of sensitive personal data (Art. 37).

If your organization doesn't fall into one of these categories, then you do not need to appoint a DPO.

• The Commission text has a fairly simple and concise ruling in favor of the principle, the Parliament also promotes a lead DPA and adds more involvement from other concerned DPAs, the Council’s view waters down the ability of the lead DPA even further.

• A more in depth analysis of the one-stop-shop policy debate can be found here: One-Stop-Shop .

1. Personal data must be processed in a lawful and transparent manner, ensuring fairness towards the individuals whose personal data you are processing ("lawfulness, fairness and transparency").

2. You must have specific purposes for processing the data and you must indicate those purposes to individuals when collecting their personal data.

   1. You cannot simply collect personal data for undefined purposes ("purpose limitation").

3. You must collect and process only the personal data that is necessary to fulfil that purpose ("data minimisation").

4. You must ensure the personal data is accurate and up-to-date, having regard to the purposes for which it is processed, and correct it if not ("accuracy").

5. You cannot further use the personal data for other purposes that are not compatible with the original purpose of collection.

6. You must ensure that personal data is stored for no longer than necessary for the purposes for which it was collected ("storage limitation").

7. You must install appropriate technical and organisational safeguards that ensure the security of the personal data, including:

   1. Protection against unauthorised or unlawful processing.

   2. Against accidental loss, destruction, or damage, using appropriate technology ("integrity and confidentiality").

1. The purpose for processing of personal data must be known and the individuals whose data you’re processing must be informed.

2. It is not possible to simply indicate that personal data will be collected and processed.

3. This is known as the "purpose limitation" principle.

If your company/organisation has collected data on the basis of legitimate interest, a contract, or vital interests, it can be used for another purpose but only after checking that the new purpose is compatible with the original purpose.

The following points should be considered:

1. The link between the original purpose and the new/upcoming purpose.

2. The context in which the data was collected (what is the relationship between your company/organisation and the individual?).

3. The type and nature of the data (is it sensitive?).

4. The possible consequences of the intended further processing (how will it impact the individual?).

5. The existence of appropriate safeguards (such as encryption or pseudonymisation).

If your company/organisation:

• Wants to use the data for statistics or for scientific research it is not necessary to run the compatibility test.

• Has collected the data on the basis of consent or following a legal requirement, no further processing beyond what is covered by the original consent or the provisions of the law is possible.

• Further processing would require obtaining new consent or a new legal basis.

Further processing is possible

• A bank has a contract with a client to provide the client with a bank account and a personal loan.

• At the end of the first year the bank uses the client’s personal data to check whether they are eligible for a better type of loan and a savings scheme.

• It informs the client.

• The bank can process the data of the client again as the new purposes are compatible with the initial purposes.

Further processing is not possible

• The same bank wants to share the client’s data with insurance firms, based on the same contract for a bank account and personal loan.

• That processing is not permitted without the explicit consent of the client as the purpose is not compatible with the original purpose for which the data was processed.

1. Where possible, it is preferable to use anonymous data.

2. Where personal data is needed, it should be adequate, relevant, and limited to what is necessary for the purpose ("data minimisation").

3. It is your company/organisation's responsibility as controller to assess how much data is needed and ensure that irrelevant data is not collected.

   Example: Your company/organisation offers car-sharing services to individuals.

   • For those services it may require the name, address, and credit card number of your customers and potentially even information on whether the person has a disability (so health data), but not their racial origin.

1. That period should take into account the reasons why your company/organisation needs to process the data, as well as any legal obligations to keep the data for a fixed period of time (for example national labour, tax or anti-fraud laws requiring you to keep personal data about your employees for a defined period, product warranty duration, etc.).

2. Your company/organisation should establish time limits to erase or review the data stored.

3. By way of an exception, personal data may be kept for a longer period for archiving purposes in the public interest or for reasons of scientific or historical research, provided that appropriate technical and organisational measures are put in place (such as anonymisation, encryption, etc.).

4. Your company/organisation must also ensure that the data held is accurate and kept up-to-date.

• Your company/organisation runs a recruitment office and for that purpose it collects CVs of persons seeking employment and who, in exchange for your intermediary services, pay you a fee.

• You plan to keep the data for 20 years and you take no measures for updating the CVs.

• The storage period does not seem proportionate to the purpose of finding employment for a person in the short to medium term.

• Moreover, the fact you don’t request updates to CVs at regular intervals renders some of the searches useless for the person seeking employment after a certain amount of time (for instance because that person has gained new qualifications).

1. Who your company/organisation is (your contact details, and those of your DPO if any).

2. Why your company/organisation will be using their personal data (purposes).

3. The categories of personal data concerned.

4. The legal justification for processing their data.

5. For how long the data will be kept.

6. Who else might receive it.

7. Whether their personal data will be transferred to a recipient outside the EU.

8. That they have a right to a copy of the data (right to access personal data) and other basic rights in the field of data protection (see complete list of rights).

9. Their right to lodge a complaint with a Data Protection Authority (DPA).

10. Their right to withdraw consent at any time.

11. Where applicable, the existence of automated decision-making and the logic involved, including the consequences thereof.

See the complete list of information to be provided.

The information may be provided in writing, orally at the request of the individual when identity of that person is proven by other means, or by electronic means where appropriate. Your company/organisation must do that in a concise, transparent, intelligible and easily accessible way, in clear and plain language and free of charge.

When data is obtained from another company/organisation, your company/organisation should provide the information listed above to the person concerned at the latest within 1 month after your company obtained the personal data;

1. Or, in case your company/organisation communicates with the individual, when the data is used to communicate with them.

2. Or, if a disclosure to another company is envisaged, when the personal data was first disclosed.

Your company/organisation is also required to inform the individual of the categories of data and the source from which it was obtained including if it was obtained from publicly accessible sources.

• Under specific circumstances listed in Articles 13(4) and 14(5) of the GDPR your company/organisation may be exempted from the obligation to inform the individual.

• Please check whether that exemption applies to your company/organisation.