Data Protection is big news

Not just because we have the looming deadline of 25th May when GDPR becomes law but also because we have all been watching the unfolding story of Facebook who, through their contractors Cambridge Analytical,  have accessed information from 50 million Facebook users without their knowledge. This user data scandal has wiped $40 billion of their share value and has had a devastating effect on the Facebook brand - from which it is debatable whether it will ever recover.

At our recent networking event with Loch Associates they gave us a very timely reminder of the significance of protecting the use and storage of the data that we, as businesses, keep and how the misuse or faulty or non-existent systems and procedures for handling data can severely damage our business value and brand.

GDPR comes into force on 25th May and aims to protect the personal data of EU citizens, regardless of borders or where the data is processed. Failure to comply with the GDPR could see businesses facing significant penalties of up to €20m, or four per cent of annual global turnover.

No matter how large or small your business is, you must comply with new regulations regarding the secure collection, storage and usage of personal information. The two central objectives of GDPR are:

• To give citizens and residents back control of their personal data.
• To simplify the regulatory environment for international business by unifying the regulation within the EU.

There are also two vital points which are worth highlighting to small businesses:

• Firms of over 250 employees must employ a Data Protection Officer (DPO). This person is responsible for ensuring that a business collects and secures personal data responsibly.
• GDPR will also apply to small businesses under 250 employees if the processing carried out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data as defined in GDPR Article 9