Decoding GDPR by CRIF Highmark

As data, the new oil of the digital era continues to drive the economies around the globe, privacyand protection of data is in the spotlight. On 25 May 2018, The European Union led the pack byenforcing GDPR into full-effect, thereby making a milestone in data protection laws across the European Union (EU).

What is GDPR?

The General Data Protection Regulation (GDPR) is a control in the EU law aimed to standardizeand strengthen citizen’s data protection rights across EU. It considers consumer to be the owner of the data, and organization has to obtain an affirmative consent from consumer to be able to use consumer’s data or allow consumer a right to delete it whenever consumer wishes to.

Who does it apply to?

All public and private organization that handle, store or process personal data of EU citizens. Applicable also to non-EU companies that process personal data in the EU.

What is Personal Data?

Personal data is at the heart of the GDPR. ‘Personal data’ means any information relating to an

identified or identifiable natural person (‘data subject’). The definition is quite broad now and

includes identifiers such as genetic, biometric, health, ethnicity, financial standing, political

opinions, IP Address etc.

Why is it necessary to adopt GDPR?

It is important to adopt GDPR to the fullest and avoid any breaches, as GDPR lays heavy

financial penalties on non-compliant organizations. One also runs into a risk of loss of

reputation. Further, Privacy by design is crucial for organisations also because it acknowledges

the need to rethink cyber security processes. The threat of data breaches rises each year, and

organisations have so far struggled to find effective solutions. Adopting a privacy by design

approach will increase organization’s awareness of privacy and data protection issues, helping

them identify and address vulnerabilities promptly.

What are the advantages of adoption of GDPR?

Strengthen Your Cybersecurity

Better Data Management

Increase Marketing Return On Investment (ROI)

Enhanced Audience Loyalty And Trust

Be The First To Establish A New Business Culture

What it means for India & Indian companies?

The new law will have both direct and indirect impact on Indian business and India’s legal

approach to privacy and data protection. Evidently as the new law kicked in, companies across

the world have updated their consent terms and privacy policies – therefore, many of us in India are getting these notification, even though it is not necessary in India as yet. While most Indian organizations are unaffected by GDPR, some Indian sectors such as IT, the outsourcing industryand pharmaceuticals might be hit by the GDPR as they have operations in EU markets.

Because of complexities involved in implementing GDPR, a new opportunity emerges for individuals and risk management companies to offer consulting and auditing services on GDPR. The new data protection framework being drafted under Justice Srikrishna Committee is likely to be influenced by the provisions under GDPR, and we may see similar need of data protection emerging for Indian businesses too.