What is GDPR

GDPR (General Data Protection Regulation) is a modern data privacy and security law created by the European Union (EU) that became effective on May 25, 2018. GDPR is a global standard for how personal data is collected, processed, and stored in a digital world. Unlike other data protection and privacy laws, GDPR was created to recognize the unprecedented interconnectedness in the world today as data is securely transmitted across borders and collected by a multitude of apps, websites, and services.

Essentially, GDPR is like giving individuals back control in the online world over their personal information. Individuals have clear rights to their data, and that places obligations on organizations that process and collect that data, regardless of whether they are in or out of the EU. If you are processing the personal data of anyone in the EU, then GDPR applies to you.

Core Principles and Individual Rights under GDPR

GDPR is founded on core principles for processing data and provides individuals with a number of very important rights:

Core principles (for organizations that process data):

• Lawfulness, Fairness and Transparency: Data must be processed lawfully, fairly, and can be easily understood by the individual.

• Purpose Limitation: Data should only be collected for specified, explicit, and legitimate purposes.

• Data Minimization: Only collect the data absolutely necessary for the stated purpose. Do not store extra information.

• Accuracy: Keep personal data accurate and up to date.

• Storage Limitation: Do not retain personal data for longer than necessary.

• Integrity and Confidentiality (Security): Process data in a manner that ensures appropriate security of the personal data, using appropriate technical or organizational means to protect against unauthorized or unlawful processing or against accidental loss, destruction or damage.

• Accountability: Data controllers must be able to demonstrate compliance with these principles.

Rights of individuals (data subjects):

• Right to be informed: Individuals have a right to know how their data is being used.

• Right of access: Individuals may request access to their personal data.

• Right to rectification: Individuals may have inaccurate data corrected.

• Right to erasure ("Right to be forgotten"): In certain circumstances, individuals may request that their personal data be deleted.

• Right to restriction of processing: Individuals may restrict the processing of their data.

• Right to data portability: Individuals may obtain and reuse their personal data for their own purposes across different services.

• Right to object: Individuals may object to certain types of data processing.

• Rights related to automated decision making and profiling: Individuals have rights relating to decisions made through automated processing alone.

Why you should be GDPR compliant as a Global Business

GDPR has an extensive reach, beyond the geographical boundaries of the EU. The GDPR comprehensive set of rules has now impacted privacy laws across the globe and it is becoming known as a de facto standard for data privacy. GDPR compliance now means much more than simply avoiding fines for organizations processing data of EU residents. GDPR compliance is a trust-builder [Changed from 'trust build near to the best practice' for clarity and conciseness] and ethical operating.

Here are reasons why good faith efforts for GDPR compliance is essential for any organization operating today:

• Protects Personal Privacy: GDPR was established to improve control over personal data individuals have, and [Added 'and' for flow] special control over privacy will develop trust, while providing respect of privacy in a digital age.

• Requires Strong Data Security: The principle of “Integrity and Confidentiality” focus welcomes strong security practices to be in place to mitigate and protect against unauthorized access, destruction, or loss of personal data. This principle requires strong IT control surrounding Identity and Access Management (IAM), Privileged Access Management (PAM), encryption, and continuity assessment of all security practices.

• Global Characteristics: An organization is subject to GDPR if it processes the personal data of EU residents, regardless of the organization's establishment. As such, GDPR is an important consideration for any organization with an online presence and/or international customers.

• Requires Data Minimization and Purpose Limitation: This principle encourages reduced information processing and consideration to collect only the personal data needed to serve a specified purpose/s. This promotes a reduced data footprint overall which promotes reduced breached risks.

• Requires Accountability and Transparency: GDPR requires organizations to demonstrate proactive and systematic compliance (records of processing activities, Data Protection Impact Assessments). Demonstrating compliance will embed an accountability culture in data processing.

• Avoid Serious Penalties: GDPR penalties for non-compliance for serious infringers can be significant: up to €20 million, or 4% of the company worldwide's annual turnover, whichever is greater. Penalties to follow non-compliance are not simply monetary; with any financial penalties there will be large reputational and financial damage.

• Generate Customer Trust and Company Reputation: In an age of data breaches, compliance at the fullest extent creates a demonstration to customers and partners demonstrating organizational seriousness toward data privacy. Which can lead to tangible value and competitive advantage.

• Improves Data Governance: GDPR principles provide organizations with a clearer/complete picture of the organization's whole data. Understanding what types of personal data they have, where it is stored, who has access to it, and how it is ultimately deleted, will provide improved data governance overall with less data available to be breached.

• Encourages Further Data Privacy Laws Development: GDPR has established a benchmark with data privacy laws development globally (by example CCPA in California, LGPD in Brazil, etc.), and remains to be taking on even more global significance.

ReShield identity security platform strongly promotes GDPR compliance; its Identity and Access Management (IAM), Privileged Access Management (PAM), Identity Governance and Administration (IGA), and Identity Security Posture Management (ISPM) capabilities seamlessly incorporate the principles underpinning GDPR. In common with GDPR, organizations will be enabled to adopt and achieve strong Least Privilege Access (LPA), strong access lifecycles management of human and machine identities, relative to Separation of Duties (SoD) requirements, and create and/or maintain ongoing granularity of data access audit trails, along with continuous visibility of each human or machine identity accessing personal data. ReShield is a strong and capable partner to fulfil organizational obligations under GDPR, protect individual privacy, and reduce compliance risks.