And what enforcement will look like for Irish companies.

In this new era of GDPR, all companies with information on European citizens must comply with the new regulation. The main principle about the General Data Protection Regulation (GDPR), is to protect customers against the misuse of their data by companies. GDPR brings more transparency and safety in relation to the use of data, benefiting both the companies and their customers. In the next paragraphs we will explain the main GDPR principles, enforcement and how to deal in case you need to communicate a data breach.

If your company is not ready yet for the compliance, New Horizons Ireland gathered a couple of useful tips and information that can help you in this process.

8 Data Protection Principles for complying with GDPR

The principles below are based in the GDPR final article and originally organised by the GDPR coalition.

01 – Fair data collection and Processing

02 – Obtain for one or more specified, explicit and lawful purposes

03 – Use and disclose data only in ways compatible with those purposes

04 – Keep it safe and secure

05 – Keep data accurate, complete and up to date

06 – Ensure that the processing is adequate, relevant and not excessive

07 – Retain for no longer than is necessary for the purpose or purposes

08 – Give a copy of his/her personal data to an individual on request

Scenarios where GDPR is applicable

At New Horizons Ireland we have been mentoring people in the new regulation since last year and one of the most important points that we learned is that GDPR evolves the whole company, cannot be a process leaded just for one person or one area. Even though, there is a selection of scenarios where the new regulation is 100% applicable. 

• EU parent company
• Personal Data Locally
• Local Suppliers
• Staff Training
• Off-site Storage
• Trading with Non-EU companies

If you wish to read the full version of those scenarios you can access here in our previous article:

Scenarios where GDPR is applicable

How to communicate a data breach in Ireland

The new era of the GDPR introduces new requirements for organisations to report personal data breaches to the relevant supervisory authority, which in Ireland is the Data Protection Commission. Companies must do it within 72 hours of becoming aware of the breach, it doesn’t matter the level of the risk, the recommendation is always to notify the responsible authorities.

The report can be done by email and before to do it you should have in mind the risk of your data breach. According to the Data Protection Commission in Ireland the risk rating can be classified as below:

• Low Risk: The breach is unlikely to have an impact on individuals, or the impact is likely to be minimal
• Medium Risk: The breach may have an impact on individuals, but the impact is unlikely to be substantial
• High Risk: The breach may have a considerable impact on affected individuals
• Severe Risk: The breach may have a critical, extensive or a dangerous impact on affected individuals.

Because in the first moment you will determine how serious you consider the breach to be for affected individuals, you should bear in mind the impact of the breach on individuals whose data has been exposed. In assessing this potential, you should consider the nature of the breach, the cause of the breach, the type of data exposed, mitigating factors in place and whether the personal data of vulnerable individuals has been exposed.

You can check the all process of notifying a data breach in the Data Protection Commission website by clicking here.

Enforcement

At the Global Privacy Summit, Irish Data Protection Commissioner Helen Dixon gave some indication of how DGPR enforcement will work.

"There will be fines, and they will be significant". "I like to twist it back around to remind everyone what the GDPR is, which is about accountability backed up by ex-post enforcement under Article 83. I think it is quite clear that when we do identify an infringement that's of the gravity, duration and scope that is serious, then we are obliged considerably to administer an administrative fine" said Dixon.

You can read more about this in IAPP's article here.

Get trained

At New Horizons Ireland we provide a wide range of GDPR courses to prepare you and your team. Check it out below:

GDPR Certifications

Other Popular GDPR courses

---