# Key GDPR facts that all businesses must understand
Author:  Pal Sinha, Barnali 
Author URL: https://financedigest.com/author/pal-sinha-barnali
Published: 2017-08-24
Category: BUSINESS
Category URL: https://financedigest.com/category/business
Meta Title: Key GDPR Facts for UK Businesses: What You Need to Know
Meta Description: Learn about the key facts of GDPR compliance for UK businesses and the potential risks of non-compliance. Get prepared for the 25th May 2018 deadline!
URL: https://financedigest.com/key-gdpr-facts-that-all-businesses-must-understandhtml

![undefined](https://prod.superblogcdn.com/site_cuid_cm5qst7v3003gwirgwqtxn8i8/images/fd240817-2-1736843577905-compressed.jpg)

**_Andy Ward,_** _director at_ _bluesource, explains the key GDPR facts that all business must be aware of_

General Data Protection Regulation (GDPR) will apply unilaterally in all EU member states, with the official compliance date being 25th May 2018. GDPR will affect any business, UK or otherwise, that collects or retains personally identifiable data from any individual in Europe. Brexit cannot be used as an excuse either, as UK companies will still need to comply when [dealing with countries](https://www.financedigest.com/eu-countries-eye-deal-on-more-energy-measures-within-weeks.html "EU countries eye deal on more energy measures within weeks") in the EU.

Non-compliance could [see organisations face fines of up to €20 million or 4 per cent of global annual](https://www.financedigest.com/experian-sees-annual-revenue-growth-on-steady-demand.html "Experian sees annual revenue growth on steady demand") turnover – whichever is higher. The increased financial impact of fines and the expected frequency of their enforcement, should be a [major concern – as failing to understand the facts](https://www.financedigest.com/north-american-market-for-veterinary-respiratory-ventilators-to-hold-lions-share-owing-to-presence-of-major-key-players-fact-mr-report.html "North American Market for Veterinary Respiratory Ventilators to Hold Lion’s Share Owing to Presence of Major Key Players: Fact.MR Report") about GDPR will prove to be costly. Ourresearch across UK organisations indicates that there is still a gap between GDPR awareness and action. I have therefore highlighted below the areas that businesses should be aware of so they start to prepare for now – to achieve [successful outcomes](https://www.financedigest.com/world-stocks-climb-on-hopes-of-successful-debt-ceiling-outcome.html "World stocks climb on hopes of successful debt ceiling outcome").

**GDPR applies to all**

If an organisation process the personal data of an EU citizen, be it consumer or business related, GDPR applies – wherever they operate. So, in effect, although this is an EU initiative, it has global implications – regardless of Brexit.

**Liability for all organisations that touch personal data**

Responsibility will no longer only rest with the data controller of the initiating organisation, but will also apply to any organisation that uses personal data provided to them. This rule will even cover aspects such as data minimisation and deletion.

**Mandatory [appointment of a Data Protection Officer](https://www.financedigest.com/future-market-insights-appoints-aditi-basu-as-chief-marketing-officer.html "Future Market Insights Appoints Aditi Basu as Chief Marketing Officer") (DPO) for certain organisations**

A DPO must be appointed, where [large scale](https://www.financedigest.com/facebook-parent-meta-is-preparing-large-scale-layoffs-this-week-wsj.html "Facebook parent Meta is preparing large-scale layoffs this week – WSJ") data processing takes place, by both public bodies and certain other entities. The criteria isdetermined by the quantity of data being processed – not an organisation’s size. The DPOwill have to ensure that personal data processes, systems, and storage not only conform to the law, but can also be evidenced to do so.

**Widening definitionof personal data**

Once the 25 May 2018 deadline has passed, any data used to identify an individual will be considered to be ‘personal data’. This will include business contact information, as well as genetic, mental, cultural, economic and social information.

**Tightening up on how ‘valid consent’ is obtained**

This is likely to become a major headache for organisations, as they will [need to be very clear about how an individual’s](https://www.financedigest.com/insurance-that-every-individual-needs.html "Insurance that every individual needs…") information is going to be used – before consent is given. They will also need to communicate how it will be processed. Consent will need to be clearly obtained, rather than via an assumption it’s been given – because someone has not ticked a box to remove themselves, as is currently often the case.

**Introduction of Privacy Impact Assessments (PIAs)**

For areas where there is a real threat of a privacy breach, [data controllers will have to conduct a PIA to alleviate the knock on risk](https://www.financedigest.com/omicron-poses-very-high-risk-but-data-on-severity-limited.html "Omicron poses ‘very high’ risk but data on severity limited") to individuals. Such projects involving personal data will require the PIA to be carried out in advance and the DPO will then [need to ensure compliance](https://www.financedigest.com/why-the-us-urgently-needs-media-compliance-auditing.html "Why the US urgently needs media compliance auditing") continues throughout the project.

**Harmonisation of [data breach](https://www.financedigest.com/amazons-twitch-blames-configuration-error-for-data-breach.html "Amazon’s Twitch blames configuration error for data breach") notification**

GDPR demands that a local data [protection authority must](https://www.financedigest.com/must-know-facts-about-the-protection-class-rating-on-your-home.html "Must-Know Facts about the Protection Class Rating on Your Home") be notified of a data breach within 72 hours of its discovery – so the burden has shifted from just being about ‘discovery’. Organisations will also have to possess the processes – and technology – in place to detect breaches in the first place. This means greater investment in both systems changes and [staff training](https://www.financedigest.com/why-training-your-staff-is-key-in-spotting-the-warning-signs-of-a-cybersecurity-breach.html "Why training your staff is key in spotting the warning signs of a cybersecurity breach").

**Introducing the right to be forgotten**

Organisations won’t be allowed to hold or retain data for any longer than is necessary. Also not permitted, is changing how data is used from what was originally agreed – at the [time](https://www.financedigest.com/data-time-for-some-levelling-up.html "Data – Time for some “Levelling Up”") the data was collected. If data is used for a new project, fresh consent will have to be obtained. The ‘right to be forgotten’ also enables an individual to request that their data is deleted in full – and this must be completed.

**GDPR compliance must be included by [design – in all software](https://www.financedigest.com/helpful-saas-softwares-to-be-aware-of-as-a-freelance-designer.html "Helpful SaaS Softwares to be aware of as a Freelance Designer"), systems, and processes**

This can be construed as meaning that all software,for example, [must facilitate the complete deletion of personal](https://www.financedigest.com/top-8-must-know-personal-finance-facts-for-2023.html "Top 8 Must-Know Personal Finance Facts for 2023") data – and this must be a key part of the design.

**There will only be a single supervisory authority**

Under GDPR, each EU state will have its own authority, but all must provide exactlythe same advice and messages. This consistency will hopefully make it simpler for businesses to deal with queries [regarding operations](https://www.financedigest.com/holcim-supports-resolution-with-u-s-regarding-legacy-operations-in-syria.html "Holcim supports resolution with U.S. regarding legacy operations in Syria") in different locations. However, any European data [protection authority will be empowered to take action](https://www.financedigest.com/british-pm-rishi-sunak-pledges-further-action-on-strikes-to-protect-lives.html "British PM Rishi Sunak pledges further action on strikes to ‘protect lives’") against an organisation – regardless of where the organisation is located.

[http://www.bluesource.co.uk](http://www.bluesource.co.uk)


---
This blog is powered by Superblog. Visit https://superblog.ai to know more.
---