he clock is ticking relentlessly towards what experts say is the biggest data protection change in a generation – and north and north-east firms need to be ready.
But what exactly is the new General Data Protection Regulation (GDPR) and how will it affect businesses and their customers?
The EU-wide legislation comes into force on May 25, 2018. In the UK, it will replace the Data Protection Act and overhaul rules designed for the era of floppy disks – updating them for the modern world of cloud computing.
It will govern the collection, use and storage of data as well as the way it is shared, and aims to provide greater security for people whenever a business needs personal information.
The new rules will apply online and offline and be enforced by large fines – up to 20million euros (£17.6million), or 4% of a company’s global turnover for non-compliance.
If you do business domestically or anywhere across the EU, GDPR and its requirements apply to you and your work. There is no minimum size a business must be before the law applies, so sole traders must work to the guidelines just the same as large corporations.
Jill Turner, human resources (HR) and employment law consultant at Aberdeen-based HR, employment law and health and safety consultancy services firm Empire, said yesterday GDPR would have much greater scope than current legislation.
She added: “It will give everybody, including employers and customers, better protection and increased rights of access to any information held about them. There will be more accountability.
“With the ease with which information can be easily shared nowadays, this brings data protection into the 21st century.”
Ms Turner said the size of potential fines was likely to sharpen firms’ focus about the need to comply, while the wider scope of the new rules would help to thwart cyber criminals.
A GDPR “summit” has been arranged in the north-east to help firms prepare. The event at Ardoe House Hotel, near Aberdeen, on November 9 will be chaired by Don Randall, a former head of security at the Bank of England. Sandip Patel QC – one of Britain’s leading cyber and data protection lawyers – and Scottish Business Resilience Centre chief executive Mandy Haeburn-Little are among the other speakers.
Mr Randall said: “Most firms are probably aware of GDPR by now, but there is still a lack of understanding as the new regulation looms on the horizon”.
Recommended for you
