GDPR SUMMARY AND DATA PROTECTION ACT 2018
GDPR summary contains what the General Data Protection Regulation is, personal data and principles to ensure data protection across the UK in line with DPA 2018.
Get In Touch
GDPR
Being the standardised data protection law, general data protection regulation directs a wide range of legislation passed by the European Union (EU) to secure and maintain the privacy of the personal data of EU citizens. UK’s GDPR version i.e. DPA 2018 takes care of this in the data protection space.
Data protection law
This law watches the UK businesses incorporate GDPR principles, adopt adequate data security strategies and technical measures to protect from the personal data leakage of the EU citizens. It also focuses on creating a security conscious workflow in the businesses aimed towards reducing cyber attacks, including privacy outbreaks.
Who does the GDPR apply to? What about post-brexit changes?
The GDPR impacts most organisations around the globe that sell goods/ products to the EU and process data of EU residents and citizens. It applies to both data processors and data controllers, therefore, legally holds them liable in case of personal data breaches.
This includes both data controllers and processors and covers multiple aspects of data usages, such as collection, storage, retrieval, alteration and destruction. Businesses can ensure adherence to EU law (GDPR) by examining the data relationship with their customers. This will help them evaluate and ensure the need for privacy mechanisms or regulatory policies to meet the expectations and specifications of GDPR.
The UK left the EU on 31st January 2020. After the transition period (from 01.01.2021), the EU GDPR no longer applies directly to the UK. UK’s equivalent of GDPR is called ‘UK-GDPR’. The DPA 2018 puts EU GDPR’s requirements into practice.
How does GDPR define personal data?
Article 4 of GDPR provides a broad context of personal data under its regulatory regime. It refers to personal data as any information relating to an identified or identifiable natural person. This definition of personal data processing includes all information that could directly or indirectly identify the individual through any one or more combination of sources.
The GDPR protects personal data irrespective of technology and applies to manual and automated processing. Some examples of personal data are:
- a name or an email address such as name or [email protected];
- an ID card number such as driving license, National Insurance (NI) number;
- home address or location data e.g. location services using mobile applications;
- IP address or online identifiers such as cookie ID, advertising identifier, etc;
- Records containing personal data such as health records, HR records, customer details, payment details, etc.
How does the GDPR differ from the Data Protection Act (DPA) 2018?
GDPR regulates the whole EU citizens’ personal information protection and is far more detailed and demands far more compliance than DPA 2018, that is, the UK implementation of GDPR. The following eight areas are the main differentiators between EU GDPR and DPA 2018.
Personal INFORMATION
An extended definition of personal data that includes identifiers such as IP address, Internet cookies and DNA.
Right to be forgotten
GDPR grants the rights to an individual to request the removal of personal data
Consent
GDPR supports individual to consent to refuse automated decision profiling
Penalties
GDPR imposes an increased level of penalties in case of a data breach or failure to comply with the regulations
Data Protection Officer
GDPR mandates the appointment of a Data Protection Officer for specific organisations that process a large amounts of particular categories of data
Privacy Impact
GDPR mandates the privacy impact assessment to verify if the organisation fulfils the individual’s privacy expectations and conditions
Child Consent
In the case of GDPR, children over the age of 16 can consent to data processing, whereas the DPA sets this at 13.
Data subject rights
GDPR embraces protected measures on subject rights , whereas DPA 2018 has waived the subject rights in some cases (scientific, historical or archiving)
Article 5 GDPR - The data protection principles
The design of GDPR to protect the data privacy rights of EU citizens is mainly developed over six fundamental principles, with the seventh principle ‘accountability’ as the UK GDPR principle. These principles are the central approach to processing personal data in line with GDPR.
- Lawful, fairness and transparency: Organization will collect and processes personal data lawfully, fairly and in a transparent manner
- Purpose limitation: The collected personal data must be used for specified, explicit and legitimate purposes
- Data minimisation: It should be adequate, relevant and limited to what is necessary
- Accuracy: Personal data records collected should be accurate and where possible kept up to date
- Storage limitation: Data should not be stored longer than required
- Integrity and confidentiality (security): Personal information processing must be done in a secure manner, ensuring data protection against unauthorised processing or unlawful processing and accidental loss, destruction or damage.
- Accountability: According to the UK GDPR regulator, ICO, accountability is the seventh data protection principle. It states: “The accountability principle requires you to take responsibility for what you do with personal data and how you comply with the other principles. You must have appropriate measures and records in place to be able to demonstrate your GDPR compliance.“
Our GDPR security testing is more than tick-box approach
GDPR Compliance
Our GDPR solutions are not aimed to push false promises with 100% security and sell fear and uncertainty. The tailored approach helps to assess and address gaps in your cyber security controls as well as strategy, helping you to prepare for detection, response and recovery against the inevitable.
GDPR breaches and fines
Since the GDPR came into effect in May 2018, there have been a number of high-profile data breaches and fines. Here are some of the most notable ones:
- In 2019, British Airways was fined £183 million for a data breach that occurred in 2018. The breach impacted 380,000 customers/public authorities.
- In 2018, Facebook was fined £500,000 for its role in the Cambridge Analytica scandal.
- In 2018, Marriott International was fined €110 million for a data breach that impacted 500 million customers under certain circumstances.
- These are just a few examples of the GDPR breaches and fines that have been levied since May 2018. The GDPR allows for massive fines of up to €20 million or four percent of global turnover.
ASSESSMENTS
Develop an understanding of your environment to manage cyber risk effectively
MANAGED SECURITY SERVICES
Outline safeguards to limit/contain the impact of an incident
SECURITY COMPLIANCE
Achieve security compliance while demonstrating your strong commitment to data security
