GDPR: Common Myths and Truths Revealed

The General Data Protection Regulation (GDPR) has been a hot topic of conversation since being adopted in April 2016. The new regulation changes how companies need to manage the data of data subjects in the European Union (EU) and will become fully enforceable starting May 25, 2018. With that date quickly approaching, we’d like to clear up some myths that we have been hearing.

Myth #1: Since my enterprise is not located in the EU, we don’t have to comply with GDPR.

Truth: Any enterprise that 1) offers goods or services to individuals in the EU, 2) processes or holds the personal data of EU residents or 3) monitors the behavior of individuals in the EU will be subject to GDPR. This includes visitors to the EU as well. GDPR would apply, for example, if an American citizen visits a U.S.-based website while vacationing in Germany and that website monitors that citizen’s behavior while in Germany.

Myth #2: Once my company becomes GDPR compliant, we will be compliant as long as GDPR is enforced.

Truth: GDPR is not a regulation that you can “set and forget.” It’s an ongoing initiative that will need to be followed by all personnel starting May 25, 2018, ad infinitum. Because of that, companies will need to continually educate personnel on maintaining awareness surrounding the integrity of personal data and GDPR.

Myth #3: Every data breach around personal data will need to be reported.

Truth: Not all breaches must be conveyed to the Information Commissioner’s Office. Those that result in risk to data subjects’ rights and freedoms, for instance, must be reported no later than 72 hours after discovery. If there is no risk, there’s no reason to report, but the matter should be documented.

Myth #4: Full monetary fines (€20 million, or 4% of worldwide annual of the prior financial year’s revenue, whichever is higher) will be assessed if your data is breached and data subjects’ rights and freedoms are exposed.

Truth: Fines will be administered by individual member state supervisory authorities utilizing the following criteria: nature of infringement, intention, mitigation, preventative measures, history, cooperation, data type, notification and certification, as well as a few other mitigating factors. Not all companies will be fined the full amount, as long as they are open, honest and report without delay.  Exercising ongoing compliance efforts and the more mature an organization is with regard to GDPR, the more likely the fines will be lessened.

Myth #5: My data is currently hosted with a cloud provider; it is their responsibility to be GDPR compliant, not mine.

Truth: Even if all your data is hosted in a third-party cloud provider’s environment (processor), it’s the responsibility of both the controllers and processors to be compliant with GDPR. As the data controller or processor, it is still your responsibility to protect and manage the personal data of your data subjects. There is no forgiveness for ignorance.

For more information regarding GDPR, please visit the Schneider Downs website, as well as the ongoing Our Thoughts On articles being published by our Risk Advisory professionals. If you have any questions related to your organization’s compliance with GDPR, please contact us.