Ayottaz can help you become GDPR compliant
Learn how we can help
Understand if your business is impacted by General Data Protection Regulations aka GDPR
Before understanding how to achieve GDPR compliance, it is important to understand what kind of businesses are obligated to comply with GDPR. Any business operating within, or with, clients/customers who are citizens of, European Union member states should comply with the General Data Protection Regulation.
GDPR meaning
At its core, GDPR is a set of rules designed to give EU citizens more control over their personal data. It aims to simplify the regulatory environment for business so both citizens and businesses in the European Union can fully benefit from the digital economy.
The reforms are designed to reflect the world we’re living in now, and bring laws and obligations – including those around personal data, privacy and consent – across Europe up to speed for the internet-connected age.
GDPR applies to
GDPR applies to any organisation operating within the EU, as well as any organisations outside of the EU which offer goods or services to customers or businesses in the EU. That ultimately means that almost every major corporation in the world needs a GDPR compliance strategy.
There are two different types of data-handlers the legislation applies to: ‘processors’ and ‘controllers’.
Data Controller
A controller is a “person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing of personal data
Data Processor
A processor under General Data Protection Regulations is a person, public authority, agency or other body which processes personal data on behalf of the controller
GDPR ultimately places legal obligations on a processor to maintain records of personal data and how it is processed, providing a much higher level of legal liability should the organization be breached.
Controllers are also forced to ensure that all contracts with processors are in compliance with GDPR.
GDPR compliance for businesses
GDPR establishes one law across the continent and a single set of rules which apply to companies doing business within EU member states. This means the reach of the legislation extends further than the borders of Europe itself, as international organisations based outside the region but with activity on ‘European soil’ will still need to comply.
Organizations are also encouraged to adopt techniques like ‘pseudonymization’ in order to benefit from collecting and analyzing personal data, while the privacy of their customers is protected at the same time.
Individual Rights under GDPR
- Right to be informed
- Right of Access
- Right to Rectification
- Right to Erasure
- Right to Restrict Processing
- Right to Data Protability
- Right to Object
What are the penalties under GDPR?
The UK GDPR and DPA 2018 set a maximum fine of £17.5 million or 4% of annual global turnover – whichever is greater – for infringements.
Th EU GDPR sets a maximum fine of €20 million (about £18 million) or 4% of annual global turnover – whichever is greater – for infringements.
However, not all GDPR infringements lead to data protection fines. Supervisory authorities such as the UK’s ICO (Information Commissioner’s Office) can take a range of other actions, including:
- Issuing warnings and reprimands;
- Imposing a temporary or permanent ban on data processing;
- Ordering the rectification, restriction or erasure of data; and
- Suspending data transfers to third countries.
20 Million
€20 million (about £18 million) or 4% of annual global turnover – whichever is greater
Ayottaz can simplify your General Data Protection Regulations compliance journey
There’s no ‘one size fits all” approach to preparing for GDPR. Rather, each business needs to know exactly what needs to be achieved to comply and who is the data controller who has taken responsibility for ensuring it happens. You are expected to put into place comprehensive but proportionate governance measures.
That could be the responsibility of an individual in a small business, or even a whole department in a multinational corporation. Either way, budgets, systems and personnel will all need to be considered to make it work.
Under GDPR provisions, companies need to implement appropriate technical and organisational measures. This could include data protection provisions (staff training, internal audits of processing activities, and reviews of HR policies), technical updations, mapping of your data as well as continuing documentation on processing activities.
Connect with us now for your initial GDPR consultation
Currently, nearly all of the information and marketing material available regarding data privacy emphasizes technical expertise and the requirements of experts in order to manage compliance. All of this seems extremely daunting to a small to medium-sized business that lacks the resources to onboard such resources. Ayottaz acts as an unbiased interface between enterprises and service providers. We are in the unique position to assure quality products and services to enterprises without any allegiance to a particular product or service. Getting the first mover’s advantage and using the platform to build long-lasting relationships with our customers will help us stay ahead of the competition in the future.
