[Day 3] 10. GDPR

General Data Protection Regulation (GDPR)

Introduction

• GDPR is a regulation by the European Union (EU) to protect the personal data of its citizens.
• It is designed to safeguard data collected primarily through websites and other digital platforms.
• Purpose: To ensure the lawful handling of European citizens' personal data.
• Applicability:
  • It is mandatory for all organisations handling data of European residents, regardless of where the organisation is located.
  • This regulation has global applicability, meaning any company dealing with EU residents' data must comply with GDPR.

Types of Cookies on Websites

Websites use cookies to enhance user experience and manage data, which are subject to GDPR compliance. Common types include:

1. Basic Authentication Cookies: Necessary for site functionality (e.g., login sessions).
2. Tracking Cookies: Used to monitor user activity, often for analytics or advertising purposes.

Websites must request explicit consent from users before using cookies, especially tracking cookies.

Key GDPR Requirements

(As outlined by Advisera) 9. GDPR.png

1. Lawful, Fair, and Transparent Processing:
   • Data must be processed lawfully, transparently, and fairly concerning the individual.
2. Limitation of Purpose, Data, and Storage:
   • Data must only be collected for specific, explicit purposes and not stored longer than necessary.
3. Data Subject Rights:
   • Individuals have rights like access, rectification, erasure (right to be forgotten), and data portability.
4. Consent:
   • Explicit consent is required for processing personal data, with the option to withdraw consent at any time.
5. Personal Data Breaches:
   • Organisations must report data breaches to supervisory authorities within 72 hours of discovery.
6. Privacy by Design:
   • Data protection measures must be integrated into the design of systems and processes from the beginning.
7. Data Protection Impact Assessment (DPIA):
   • Conduct risk assessments to identify and mitigate risks related to personal data processing.
8. Data Transfers:
   • Data transfers outside the EU must meet strict conditions, such as using adequacy decisions or standard contractual clauses (SCCs).
9. Data Protection Officer (DPO):
   • Appoint a DPO if the organisation processes large volumes of sensitive data or monitors data subjects systematically.
10. Awareness and Training:
    • Employees must be trained to understand and comply with GDPR requirements.

Importance of GDPR Compliance

• Penalties for Non-Compliance:
  • Organisations can face fines of up to €20 million or 4% of global annual turnover, whichever is higher.
• Ensures trust and transparency with customers.
• Helps organisations align with best practices for data privacy and protection.

For a detailed overview, visit: GDPR Requirements