Security is under the spotlight—and CISOs are expected to perform. This guide helps you report with precision, connect metrics to risk and resilience, and give executives what they need to lead with confidence.
GDPR Compliance: An Advanced Guide
Tags:
The General Data Protection Regulation (GDPR) is a pivotal framework that governs data protection and privacy for individuals within the European Union (EU). Its implications are far-reaching, affecting organizations worldwide that handle EU citizens' data. Understanding and achieving GDPR compliance is essential to avoid substantial penalties and to maintain trust with customers.
General Data Protection Regulation (GDPR) compliance
GDPR compliance entails adhering to the regulations set forth by the law, which aim to protect personal data and uphold the privacy rights of individuals. Personal data is defined as any information which is related to an identified or identifiable natural person. For other definitions, read our breakdown of key GDPR terms.
Organizations must implement appropriate technical and organizational measures to ensure data security, transparency, and accountability in their data processing activities.
Who is subject to GPDR?
Entities that either control or process personal data should be GDPR compliant.
A data controller is any natural or legal person, public authority, agency, or other body that determines the purposes and means of the processing of personal data. In essence, they decide the "why" and "how" data is processed. For example, a healthcare provider that collects patient data on a certain system of their choosing.
A data processor is any natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller; this means they don’t make decisions about how that data is handled. For example, a payroll company that processes employee salary and tax information for a company (the data controller) based on their instructions.
Although processors operate under the instructions of controllers, they must still comply with GDPR requirements when handling personal data. Read more about how controllers can manage cyber risk from their data processors.
Keys to achieving GDPR compliance requirements
The GDPR establishes stringent principles around lawfulness, fairness, and transparency that organizations must follow, including:
- Lawful Processing: Data must be processed lawfully, fairly, and transparently.
- Data Minimization: Only data necessary for the specified purpose should be collected.
- Accuracy: Data must be accurate and kept up to date.
- Storage Limitation: Data should be retained only as long as necessary.
- Integrity and Confidentiality: Data must be processed securely to prevent unauthorized access.
GDPR compliance checklist
Subject organizations should start by assessing their current practices to identify gaps and develop an action plan. Achieving GDPR compliance involves several critical steps:
- Data Mapping: Create an inventory and document your processes that relate to personal data collection, processing, and storing. Consider the types of data your organization collects, its source, reason for collection, ways it is processed, and when/how it’s disposed of.
- Legal Basis Assessment: Determine the lawful basis for each data processing activity.
- Policy Development: Create clear data protection policies and procedures. Ensure the information and the consent language you provide to your customers is transparent, clear, unambiguous, and written in plain language.
- Employee Training: Educate staff on GDPR requirements and data protection best practices.
- Third-Party Management: Have an understanding of where and how you share personal information with third parties, and ensure that you have the correct contracts in place with these processors to comply with GDPR. Continuously monitor your vendors to assure ongoing compliance.
- Regular Audits: Conduct periodic reviews to assess compliance and address any gaps. Engaging with external auditors can provide additional assurance.
- Data Protection Officer (DPO): If required under the conditions of Article 37, designate a DPO to oversee data protection strategies, monitor compliance, cooperate with the supervisory authority, and provide advice where requested.
- Data Protection Impact Assessments (DPIAs): Evaluate and mitigate risks associated with any new project that is likely to involve “a high risk” to personal data.
- Technical Security Measures: Implement encryption, multi-factor authentication, and regular security assessments to mitigate vulnerabilities and prevent data breaches.
- Data Subject Rights: Ensure mechanisms are in place for individuals to exercise their rights, such as access, rectification, and erasure of their data, as well as the right to object.
- Establish Data Breach Response Plans: Develop procedures to detect, report, and investigate data breaches promptly.
GDPR compliance across the globe
While GDPR is an EU regulation, its reach extends globally. Any organization, regardless of location, that processes the personal data of EU residents must comply with GDPR. This extraterritorial scope means that businesses worldwide need to be aware of and adhere to GDPR requirements.
U.S. companies that handle EU citizens' data are subject to GDPR too. This includes e-commerce sites, service providers, and any business offering goods or services to EU residents. Non-compliance can result in significant fines and legal challenges.
GDPR cookie compliance
Cookies that collect personal data are subject to GDPR. Organizations must obtain explicit consent from users before placing such cookies on their devices. This involves providing clear information about the cookies' purposes and ensuring users can opt in or out easily. Regular reviews of cookie practices are essential to maintain compliance.
GDPR and CCPA compliance
The California Consumer Privacy Act (CCPA) shares similarities with GDPR, but has distinct requirements. Organizations operating in both jurisdictions must navigate these differences to ensure compliance with both laws. This may involve implementing separate processes for data access requests and understanding the specific definitions and rights under each regulation.
Risk of non-compliance with GDPR
Intentional infringement, a failure to take measures to mitigate damage, or lack of collaboration with authorities can be the cause for penalties. For especially severe violations, listed in Art. 83(5), the fine framework can be up to €20 million, or in the case of an undertaking, up to 4% of the company’s total global turnover of the preceding fiscal year, whichever is higher. Beyond financial repercussions, organizations may suffer reputational damage, loss of customer trust, and legal actions. Therefore, adhering to GDPR is not only a legal obligation but also a critical component of responsible business practice.
GDPR compliance is a comprehensive and ongoing process that requires diligence, transparency, and a commitment to data protection principles. By following the guidelines outlined above, organizations can navigate the complexities of GDPR and build a robust framework for data privacy and security.
Show Your Leaders What Security Success Looks Like
GDPR compliance FAQs
Is double opt-in required for GDPR?
No, double opt-in is not explicitly required under the General Data Protection Regulation (GDPR). However, it can be a recommended practice to help demonstrate valid, informed consent—especially in email marketing. GDPR requires that consent be freely given, specific, informed, and unambiguous. While a single opt-in process can meet these criteria, double opt-in provides an added layer of verification that helps organizations document and prove that consent was obtained properly.
What is a requirement for controllers under the GDPR?
Under the GDPR, data controllers are required to implement appropriate technical and organizational measures to ensure and demonstrate that data processing is compliant with the regulation. This includes maintaining records of processing activities, ensuring transparency with data subjects, enabling rights like access and erasure, and working with processors that offer sufficient guarantees of GDPR compliance. Controllers must also notify supervisory authorities of data breaches within 72 hours, where feasible.
What level of encryption is required for GDPR?
The GDPR does not mandate a specific encryption algorithm or level, but it does require that organizations implement "appropriate technical and organizational measures" to protect personal data. Encryption is explicitly mentioned as a recommended safeguard. The chosen level of encryption should reflect the sensitivity of the data, potential risks, and the state of the art in data protection. Common standards include AES-256 for data at rest and TLS 1.2 or higher for data in transit.
Is SSL required for GDPR?
SSL (Secure Sockets Layer) is outdated and has been replaced by TLS (Transport Layer Security), which is the industry standard for encrypting data in transit. While the GDPR doesn’t explicitly require SSL or TLS by name, it does require appropriate security measures for protecting personal data during transmission. Using TLS is considered a best practice and is often necessary to meet GDPR's expectations for safeguarding data in transit over networks.
Does GDPR require consent for third-party cookies?
Yes, under the GDPR—particularly when interpreted alongside the ePrivacy Directive—organizations must obtain explicit, informed consent before placing or accessing most third-party cookies on a user's device. This includes cookies used for advertising, tracking, or analytics. Consent must be given before the cookies are set, and users should have a clear, easy way to refuse or withdraw consent at any time.
What are the reporting requirements for data breaches under GDPR?
Under the GDPR, organizations must report personal data breaches to the relevant supervisory authority within 72 hours of becoming aware of the breach—unless the breach is unlikely to result in a risk to the rights and freedoms of individuals. If the risk is high, affected individuals must also be informed without undue delay. The report should include details such as the nature of the breach, the categories and number of data subjects affected, likely consequences, and measures taken or proposed to address the breach.
