The GDPR Directive

“The EU General Data Protection Regulation (GDPR) replaces the Data Protection Directive 95/46/EC and was designed to harmonize data privacy laws across Europe, to protect and empower all EU citizens data privacy and to reshape the way organizations across the region approach data privacy.”

GDPR – Behind the Scene

Times change, so does the technology, so must the law.

With the revolutionary Digital Era, has come progress, that could barely be conceived at a time before. International Data Corporation (IDC) made jaw-dropping predictions that the amount of digital data created worldwide would shoot to 180 zettabytes by 2025. To handle this amount of digital data, rules must be updated and managed to protect the user.

According to the EU’s official GDPR website, the legislation is designed to “harmonize” data privacy laws across Europe as well as give greater protection and rights to individuals.

But this wave of change in the laws isn’t an overnight revolution. It took four long years and counsel with 28 states to diligently formulate what has now shaped into the General Data Protection Regulation. It is an improved version of the laws originally drafted in 1995.

Though formulated by the European Union and put into effect in Europe, if you think not being operational here means you can steer away from GDPR, think twice! GDPR applies to any organization that processes the data of EU subjects, irrespective of their location of operation. If your user is a resident of any country under EU, then your organization must comply with the mandate. Compliance is a must for all organizations, especially those that rely on SaaS products.

Failure to do so would result in mighty fines that can bleed your wallet dry. How dry? Well, according to reports, the average fine under the GDPR is 79 times greater than currently existing penalties.

Thus align your organization’s policies complying with GDPR before the 25th of May, 2018 which is the deadline to comply.

The 12 Clauses of GDPR Broken Down

Clause 1. Definitions

The clause involves the basic definitions that would appear throughout the document. It acquaints the reader of what a particular means. It includes the following key terms:

the data exporter
the data importer
the subprocessor
the applicable data protection law
technical and organizational security measures

Clause 2. Details of the Transfer

Includes specifics on the Personal Data transferred by the data exporter to the data importer. The data exporter means the controller who transfers the personal data while the data importer implies the processor who agrees to receive from the data exporter personal data intended for processing on his behalf.

Clause 3. Third-Party Beneficiary Clause

This section throws light on the data subject; how it must be transferred and processed in case the data exporter or importer is inoperational.

Clause 4. Obligations of the Data Exporter

It involves the responsibilities of the data exporter regarding the processing and transfer of data.

Clause 5. Obligations of the Data Importer

It involves the responsibilities of the data importer regarding the processing and transfer of data.

Clause 6. Liability

This clause involves the liabilities of the parties involved in case of any deviation from the clauses.

Clause 7. Mediation and Jurisdiction

This section throws light on the claims/ compensations for any damages.

Clause 8. Cooperation with Supervisory Authorities

This section enlightens the parties involved regarding their interaction with the supervisory authorities in the event of any unplanned hiccup.

Clause 9. Governing Law

This section says that the Clauses are governed by the law of the Member State in which the data exporter is established.

Clause 10. Variation of the Contract

This talks about how the participating parties cannot modify the clauses, and only business-related add-ons can be accommodated.

Clause 11. Subprocessing

This section deals with subprocessing; which is essentially entitling the right to engage sub-processors to process data.

Clause 12. Obligation After the Termination of Personal Data Processing Services

This final clause deals with the transfer of data back to the exporter once the contract is terminated.

Going about the GDPR Compliance

Non-compliance with GDPR will get you into some serious trouble. Not to mention the eyebrow-raising penalty that rides along. If you are panicking at the eleventh hour without having your policies aligned with GDPR, worry not! We have rounded up six quick, actionable modules for your GDPR compliance and to give your customers an uninterrupted, smooth experience. To further streamline this journey, many businesses also turn to compliance automation tools that help manage tasks like data mapping, breach reporting, and DPA documentation more efficiently.

1. Chart-Out Your Data Processing Workflow

The workflow starts when the customer initiates his order. The step that follows is gathering the nature of what they expect from you. Learn customers’ needs and divide the tasks to your employees. Next it’s time to hear from them if you have delivered what was promised. Find out how happy they are with your services and you can make amends for providing a better experience in future!

Setting out a clear plan on how each request, query or complaint must be dealt with will give you immense clarity. In such cases it’s easy to spot and isolate if and when things go wrong. Divide the collective tasks into smaller sub-tasks, delete any redundant steps to improve resource utilization. This will also help to optimize indispensable tasks!

2. Appoint a Data Protection Officer

The purpose of appointing Data Protection Officers is to reinforce data security further in a company. So it’s best to designate a DPO who’ll be in charge. The importance of having a DPO in your organization arises from two scenarios:

When you deal with sensitive data.
When the core functionality of your business involves handling personal data of users.

It is thus ideal to have someone who is dedicated to data protection in your organization.

3. Tighten up Your Security

This comes as no surprise because GDPR is stronger, stricter and unforgiving compared to its predecessors. It is always better to be safe than sorry. Hefty sums are levied as fine upon security breach, and the laws don’t take such scenarios lightly!

4. Revamp Your Privacy Policy

With the GDPR deadline around the corner, a solid revamp of your Privacy Policy is critical to comply with it. Edit the clauses, tweak the policies and roll it out!

5. Set Right Your DPA

This comes as a no-brainer since the whole purpose of GDPR is to improve the personal data of the users. All organizations engaging residents of EU would be under scrutiny for providing maximum data security.

6. Have a Breach Mitigation Plan in Place

Despite your best efforts, there might be some unfortunate situations you want to avoid at all costs. The worst nightmare of an organization whose crux is handling and processing data would be a data breach.

GDPR policy instructs organizations to inform the concerned regulatory body within a time span of 72 hours of identifying the breach. Have a well-laid out breach plan in place, so you don’t have to run hither and thither if at all it does.

GDPR aims at providing top-notch data security to its subjects. And rightly because data security has become a virtual reality in today’s world. Aligning your organization’s policies to match the guidelines would help you serve your clients better and provide improved cybersecurity.

GDPR Compliance for SaaS Startups in Less Than 10 Minutes