The General Data Protection Regulation (GDPR) will come into force on 25 May 2018, and the British government has confirmed it will adopt the legislation while the country remains in the EU.
With less than 18 months to go until implementation, many of them remain entirely unprepared. More than half (54 percent) of organizations have failed to commence any kind of preparation to meet even the minimum standards of GDPR, according to recent research by information management company Veritas.
The regulation enforces complex data obligations for companies that current policy is unlikely to satisfy, and damaging fines for breaches.
What is the GDPR?
The GDPR was adopted by the European Parliament in April 2016 following four painstaking years of deliberation. The provisions reinforce data protection in line with contemporary concerns about personal information, and apply to both EU member states and organizations outside the union when processing the data of citizens within it.
Regulations have been harmonized to ease compliance, with one set of laws applying across all 28 member states. The clarity comes with severe penalties for violations. Breaches could result in a fine of up to 20 million (£17 million) or four percent of worldwide revenue, whichever is higher.
The sweeping legislation presents a range of compliance and operational challenges for British businesses, requiring thorough planning and additional resources.
GDPR explained: Company fears
Almost 40 percent of businesses are fearful of a major compliance failing, while just under one third (31 percent) are worried about reputational damage from poor data policies, according to the Veritas survey of more than 2,500 senior technology decision makers.
Collective responsibility is essential to prevent such fears being realized. The GDPR requires privacy protection by design and by default, which needs a comprehensive compliance programs supported throughout the organization, according to a report by software company Avepoint and privacy think tank the Centre for Information Policy Leadership (CIPL).
It recommends embedding data security requirements throughout the organization at every stage of each business processes, from planning to release.
GDPR explained: Business-wide commitment
Confusion reigns over who bears responsibility for the regulation. Almost one third, (32 percent) of respondents believe the chief information officer is responsible, versus 21 percent for the chief information security officer, 14 percent for the chief executive officer and 10 percent for the chief data officer.
According to the Avepoint and CIPL report, they all are.
"GDPR and data privacy compliance are closely related to a company's data strategy, big data and analytics, and data-driven innovation," it states.
"It also supports the fact that data is critical to many business processes, products, and services. This is why GDPR implementation must be a concerted effort across the organization, with the DPO working hand-in-hand with Chief Data Officer (CDO), Chief Information Officer (CIO), Chief Information Security Officer (CISO) and other senior leadership."
"The board needs to understand the implications of the GDPR and be bought into the need to make enhancements," says Mark Thompson, the global privacy advisory lead at audit, tax and advisory firm KPMG. "This should result in the funding being made available to undertake a privacy improvement program."
GDPR explained: Reporting security breaches
Data controllers must notify data protection authorities of any breach that risks the rights of individuals within 72 hours of their becoming aware of it and any affected individuals in the case of a high risk breach as soon as possible. When a data processor discovers a breach, it is their responsibility to notify the controller.
Many organizations will already have a procedure for reporting breaches and an internal plan for responses.
"This will enable them to comply with the new requirements for notifying data protection authorities and individuals affected in the wake of a breach," states the Avepoint and CIPL report.
"However, unlike in the US where breach notifications are mandatory in almost every jurisdiction, only a minority of organizations conduct 'dry runs' of their breach notification plans, have cyber insurance, or retain public relations and forensic experts."
Implementing these measures will go a long way towards ensuring the reporting requirements are followed.
GDPR explained: High risk data
Formal Data Privacy Impact Assessments (DPIAs) are required when using new technologies and for any data deemed "high risk" to the rights and freedoms of individuals.
These include systematic and extensive processing activities, large scale processing of special categories of data or personal data relation to criminal convictions or offences and large scale, systematic monitoring of public areas (CCTV).
Establishing a risk assessment framework is a wise way of managing data privacy and ensuring compliance. The Information Commissioner's Office (ICO) recommends including a description of the processing operations and purposes, an assessment of the needs of the processing in relation to the purpose, an assessment of the risks and the measures in place to address them.
GDPR explained: Handling and processing data
New data portability rights allow an individual to transmit their personal data to another controller in a machine readable format. Organizations must also protect individuals' right to be forgotten when their data is no longer relevant or necessary. Procedures should be established to support both these requests.
Data processing policies and practices will also require a review, as processors are now subject to GDPR obligations and the requirements of their processing agreement with a controller have been expanded. Internal records must be kept of all data processing activities, with the data tagged and classified.
GDPR explained: What about Brexit?
The implementation of such transformative regulation represents a major challenge for British businesses, augmented by the impact of Britain's the impending exit from the European Union. Waiting to act would not be wise.
Non-EU companies still have to comply when the data passes through the EU, even when they have no influence on its direction. The uncertainty will inevitably risk breaches if a comprehensive transitional agreement isn't in place.
The UK is likely to follow the GDPR regulations both before and after Brexit, but if it no longer applies, national laws implementing EU directives will remain in force.
"The UK will become a 'third country' under the data transfer rules in the GDPR," says Alistair Maughan, a partner in the London office of international law firm Morrison &Foerster.
"In this case, personal data can only be exported by a business established in the EU to a third country, such as the UK, if there is an "adequate level of protection" for such data, unless certain conditions have been met.
"This may require businesses to put in place alternative data transfer arrangements for transfers from within the EU to the UK, at least for a period of time while adequacy status is confirmed."
GDPR explained: Staying positive
The implications of the GDPR may appear overwhelming, but the regulations should have a positive impact on both the public and the organizations responsible for upholding them.
"GDPR also represents an opportunity for organizations to consider data privacy compliance more strategically and holistically, as it becomes key to their data strategy and the digital transformation of their business," says Bojana Bellamy, president of the CIPL.
With the appropriate planning, policies and staff training, the regulation, organizations can benefit from greater support if the public feel comfortable that their data is being protected, says Information Commissioner Elizabeth Denham.
"I see this as good news for the UK. One of the key drivers for data protection change is the importance and continuing evolution of the digital economy in the UK and around the world. That is why both the ICO and UK government have pushed for reform of the EU law for several years," she wrote in the ICO blog in November.
"The digital economy is primarily built upon the collection and exchange of data, including large amounts of personal data - much of it sensitive. Growth in the digital economy requires public confidence in the protection of this information."