Category: GDPR

This article is part of our GDPR compliance service hub page, where we cover essential topics around data privacy, compliance, and responsible data handling. As Data Privacy Day highlights the importance of protecting personal information, this blog explains key privacy principles, why they matter for organizations, and how strong privacy practices can help build trust with customers and stakeholders.

In an era where data is considered the new currency, the importance of safeguarding personal information cannot be overstated. As we observe Data Privacy Day, it’s crucial to delve into what data privacy entails, explore key global regulations, and outline best practices for end users to protect their sensitive information.

What is Data Privacy?

Data privacy is the concept of protecting an individual’s personal and sensitive information from unauthorized access, use, or disclosure. This includes any data that can be used to identify an individual, such as names, addresses, financial details, and even digital footprints. The specific data covered under data privacy can vary based on laws and regulations in different regions, but generally includes:

• Personal Identifiable Information (PII): Names, addresses, phone numbers, email addresses.
• Financial Information: Credit card numbers, bank account details, financial transactions.
• Health Information: Medical records, prescription details, health insurance information.
• Biometric Data: Fingerprints, retina scans, facial recognition data.
• Location Data: GPS coordinates, tracking information, geolocation data.
• Online Identifiers: IP addresses, usernames, device IDs.
• Employment Information: Work history, salary details, employee identification numbers.
• Web Browsing History: Cookies, search history, online activity logs.
• Social Media Data: Profiles, posts, interactions.
• Communication Data: Emails, messages, call logs.
• Children’s Information: Data related to individuals under a certain age.
• Sensitive Personal Information: Ethnicity, religious beliefs, sexual orientation.
• Consent Records: Information related to obtaining and managing consent for data processing.
• Preferences and Behaviour Data: Shopping preferences, user behaviour on websites and applications.
• Metadata: Information about other data, such as creation dates or modifications.

Data privacy laws, such as the General Data Protection Regulation (GDPR) in Europe or the Health Insurance Portability and Accountability Act (HIPAA) in the United States, often provide guidelines on how organizations should handle and protect these types of data. Compliance with these laws is essential to safeguard individuals’ privacy rights.

Key aspects of data privacy include:

• Confidentiality: Ensuring that personal information is kept confidential and is not disclosed to unauthorized individuals or entities.
• Integrity: Ensuring the accuracy and reliability of personal data by preventing unauthorized alteration or tampering.
• Security: Implementing measures to protect personal information from unauthorized access, data breaches, and cyber threats.
• Transparency: Providing clear and understandable information to individuals about how their data is collected, used, and shared.
• Consent: Obtaining explicit and informed consent from individuals before collecting or processing their personal data.
• Purpose Limitation: Collecting and using personal data only for specified, legitimate purposes and not using it in ways that are incompatible with those purposes.
• Data Minimization: Collecting only the minimum amount of personal data necessary for the intended purpose.
• Accountability: Taking responsibility for the protection of personal data and being able to demonstrate compliance with relevant data privacy laws and regulations.

As technology advances and data becomes more pervasive, various laws and regulations have been enacted globally to establish guidelines for organizations on how to handle and protect personal information. Organizations are required to adhere to these regulations and implement measures to safeguard individuals’ privacy rights.

Key Global Regulations:

Several regulations across the globe aim to safeguard the privacy of individuals and hold organizations accountable for the handling of personal data. Here are some of the key regulations:

1. General Data Protection Regulation (GDPR): Enforced by the European Union, GDPR sets stringent guidelines for the collection and processing of personal data. It grants individuals greater control over their information and imposes severe penalties for non-compliance.
2. California Consumer Privacy Act (CCPA): Focused on California residents, CCPA empowers consumers to know what personal information is collected and gives them the right to opt out of the sale of their data.
3. Personal Information Protection and Electronic Documents Act (PIPEDA): In Canada, PIPEDA governs how private-sector organizations handle personal information during commercial activities.
4. Health Insurance Portability and Accountability Act (HIPAA): In the United States, HIPAA regulates the protection of health information and ensures its confidentiality and integrity within the healthcare industry.
5. Personal Data Protection Act (PDPA): Singapore’s PDPA provides a comprehensive framework for the proper collection, use, and disclosure of personal data by organizations.
6. Privacy Act: In Australia, the Privacy Act establishes rules for handling personal information by federal government agencies and private sector organizations.

Best Practices for End Users:

To fortify data privacy, end users play a pivotal role in adopting best practices. Here are six essential guidelines for individuals to protect their personal information:

• Strong Passwords and Authentication: Encourage the use of strong, unique passwords and two-factor authentication to add an extra layer of security to online accounts.
• Regular Software Updates: Ensure that all devices and applications are regularly updated to patch vulnerabilities and protect against potential security breaches.
• Be Mindful of Phishing Attacks: Educate users about recognizing and avoiding phishing emails, messages, and websites that aim to trick them into divulging sensitive information.
• Review Privacy Settings: Regularly review and adjust privacy settings on social media platforms and other online services to control the amount of personal information shared.
• Limit Data Sharing: Encourage users to be cautious about sharing personal information, especially on public forums and websites. Only provide necessary details when required.
• Secure Wi-Fi Connections: Use secure and encrypted Wi-Fi connections, avoid public networks for sensitive transactions, and consider using virtual private networks (VPNs) for additional protection.

Data Privacy Day serves as a reminder for individuals and organizations alike to prioritize the protection of personal information. By understanding the essence of data privacy, adhering to global regulations, and implementing best practices, end users can contribute significantly to creating a safer digital environment for everyone.

Knowing how to obtain consent under the General Data Protection Regulation (GDPR) and when to do so might be challenging. Many individuals wrongly believe that organisations must obtain consent before processing personal data however, consent is simply one of six legal justifications, and you should only use it if all other options have been exhausted.

Other acceptable grounds include:  A contract with the person, such as one under which obligations under an employment contract must be fulfilled or goods or services must be provided as per their desire. When processing data for a certain purpose is required by law, compliance is required. Vital interests, such as protecting someone’s physical integrity or life (either the data subject’s or another person’s), are examples of vital interests. An official function or duty that serves the public interest is an example of a public task. This often applies to public institutions including government agencies, educational institutions, hospitals, and the police.

Legitimate interests: When a private-sector organisation has a true and legitimate reason (including a financial profit) to process a person’s personal data without their consent, provided that this reason does not exceed any detrimental consequences on the person’s rights and freedoms. You need to be aware of your responsibilities since there may be circumstances in which permission is the most suitable legal basis.

Opt In vs Opt Out

The GDPR specifies conditions for legitimate requests for consent, but consent must also be given with a definite affirmative response. In other words, rather than pre-ticked boxes, people need a method that demands a deliberate decision to opt in. The ICO (Information Commissioner’s Office) asserts that opt-out alternatives “are effectively the same as pre-ticked boxes, which are outlawed,” even though the GDPR does not expressly forbid opt-out consent.

Examples of demands for valid consent include:

• Signing a consent statement on a paper form
• Clicking an opt-in button or link online
• Selecting from equally prominent yes/no options
• Choosing technical settings or preference dashboard settings
• Responding to an email requesting consent
• Answering yes to a clear oral consent request
• Volunteering optional information for a specific purpose (such as optional fields in a form)
• Dropping a business card into a box

The issue is that in order for a request for consent to be valid, the person must clearly take an affirmative action. Consent requests must not in any way rely on silence, passivity, default configurations, exploiting indifference or inertia, or default prejudice.

Problems with consent :  Because individuals now have more control over their data under the GDPR, relying on consent can be risky and time-consuming. For instance, you will need to obtain everyone’s approval once more if you are processing personal data with their consent and later decide to use that data for a different purpose. You must delete from your files anyone who declines or doesn’t respond.

Furthermore, people have the right to withdraw their consent at any moment, which once again requires you to delete them from your database. If you don’t do this, the relevant supervisory authority may discipline your organisation.

Additionally, you may find yourself in a catch-22 situation if a data subject withdraws their consent and you later realize you are required by law to continue processing the data. In other words, you either fail to fulfil your legal obligation to handle the data or you are compelled to violate privacy law by processing the data after consent has been withdrawn.

Introduction of GDPR

The importance of the protection of private data and the business risks associated with it has increased post-GDPR. The reasons might be several, ranging from the large penalties posed for non-compliance to bringing an exclusive legal framework for data protection but it can be said that business organizations now view data protection with adequate caution.

What is GDPR?

GDPR stands for General Data Protection Regulation. It is an important legal framework for data privacy formed by the European Union. The European Commission decided to plan the data protection framework for its business organizations in 2012 and later GDPR was introduced as one of the major parts of this reform. GDPR’s applicability extends to the organizations in Europe, the organizations in all its member states across and beyond Europe.

7 Principles of GDPR

The GDPR uses 7 principles to optimize data privacy in an organization. Let us first take a look at the seven principles of GDPR:

1. Lawfulness, fairness, and transparency- The GDPR states that processing of data must have proper reasons and the reasons can include or extend to any of the below: You have the user’s consent.
   • You need to process it for a contract.
   • It is crucial for fulfillment of any legal obligation.
   • For the protection of the vital interests of a natural person.
   • It is done in the public interest.
   • You have a legitimate interest.
2. The data handling and reason for data processing must be transparent. The way of dealing with personal data must be fair and with the consent of the user without any withholding or misuse of data.
3. Purpose limitation- The GDPR limits the purpose of data processing. It states that data must be collected for specified, explicit, and legitimate purposes only. The purpose for data usage must be clearly defined, communicated to relevant users, and adhered to strictly. Any purpose or need for data processing arising out of the defined scope must have updated consent.
4. Data minimization- GDPR not only limits the purpose of the data collected but also the data itself. It restricts the amount of data collected for the specified purpose to the minimum. Collection and processing of any excess data must be avoided.
5. Accuracy- Data collected and processed must be limited, defined to a purpose, and must be accurate. Any inaccurate data must be erased and data storage must be cleaned at regular intervals.
6. Storage limitation- Storage of data must be specified to a fixed duration. Data retention periods must be specified and any data which is not used after a certain period must be anonymized.
7. Integrity and confidentiality- Data stored must be protected from threats and must be confidential. Handling of confidential data must be done with complete integrity and diligence to avoid data breaches or data loss.
8. Accountability- It is not merely enough to follow the principles prescribed by the GDPR, but also a considerable amount of accountability has been created by the need for evidence. There must be a complete documentation of all procedures followed. Adequate evidence must be produced by the organization demonstrating the compliance of the organization with the GDPR requirements.

Effects of GDPR non-compliance:

The repercussions of not being GDPR compliant depends on the severity of the data breach and how severely the organization has followed the GDPR requirements previously. It can be anything from a fine ranging from 10 million euros to four percent of the company’s annual global turnover.

For instance, an organization that has committed an infringement of rights of its data subjects or unauthorized transfer of personal data internationally, or detaining requests of subjects for access of their data will have to pay a maximum penalty of 20 million euros or four percent of worldwide turnover – whichever is greater. These kinds of losses sometimes lead to billions for big organizations.

The wholesome impact of the GDPR approach

What are the impacts of achieving  GDPR compliance  in an organization? Read through:

• Increase in customer trust: The GDPR lays down frequent audits of data protection activities and employs a Data Protection Officer (DPO) as a mandatory requirement. Compliance with such data protection principles makes sure that necessary operational practices are in place and this increases the trust of the customers.
• Improved data security: The access to critical data must be restricted only to necessary resources and the GDPR ensures this through its requirement of privileged identity access management. The GDPR has laid down a strong foundation for data security. It goes a step further and states that any data breach or exposure of data to unauthorized personnel must be reported within 72 hours of occurrence.
• Cuts down maintenance costs – The GDPR lays down that any data or software or internal applications which are redundant. It requires an organization to keep all their up to date to be compliant with the GDPR requirements and this way, the costs related to storage and retention of old data is cut down.
• Constantly evolving technology- There are multiple advantages to staying up-to-date from better management of business demands internally to offering better quality to customers externally. The GDPR pushes an organization to stay at its best and latest technology constantly, pushing it to adapt to migrating trends like cloud computing, BYOD, virtualization, etc.
• Improved decision making- The requirements laid down by GDPR are such that the organizational data and data management will become more consistent and consolidated, which in turn makes it easier to use for automation and analysis. This decreases arbitration and improves the decision-making in the organization.

How GDPR enables optimum data privacy?

The GDPR is not merely a legal requirement, but a legislation that provides wide scope for the achievement of better data security and privacy while striking a balance between advancement in business and technology. The GDPR uses tools like pseudonymization and its seven principles to demonstrate better privacy within the organization.

Anonymization and pseudonymization of data are critical tools through which the GDPR enables optimum data security and privacy in the organization. Using the concept of  pseudonymization, data can be partially anonymized:

• When data is collected, the user’s identity is replaced with a unique random pseudo-identity.
• The relationship between the user’s identity and pseudo-identity is stored separately.
• The data user can be determined with the help of the mapping data stored separately.
• The data is regarded as pseudonymized.
• It is crucial to keep this mapping data safely stored. On deletion of the mapping data, the data gets fully anonymized.

The GDPR enables optimization of data privacy in every step of meeting its requirements, right from understanding the purpose of data collection, defining the scope of data collection, minimizing the amount of data collected and stored, obtaining adequate consent from data users for collection, and maintenance of documentation for all the processes followed.

It is the basic requirement of the GDPR to follow lawfulness, fairness, and transparency of data irrespective of whichever process is followed. It is a continuous and evolving process to achieve the principles of the GDPR and this process enables an organization to exercise optimum privacy of personal d

Assessment process followed by QRC –

We at QRC, provide  GDPR assessment  services and can lead you through the road-map of staying GDPR compliant. Take a look at our implementation process:

• GDPR Readiness Check Questionnaires- This is done to determine the amount of data risk present in the current situation, to check if the organization is GDPR-ready.
• GDPR Gap Analysis – Ascertaining the position of the organization in terms of GDPR requirements and conducting a gap analysis to determine plans for reaching the standards.
• GDPR Data Flow Audit- A data flow audit is conducted with a prepared data flow map. This is to clearly define what personal data is stored and how it is stored.
• On-site audits- An on-site audit is conducted with a questionnaire to identify how the organization’s improved practices demonstrate readiness.

Data Protection Impact Assessment (DPIA)- All new processes introduced in time, need to undergo assessment for data protection risks associated with them and a remediation plan to mitigate those risks.

The European Union (EU) is known for its strict regulations when it comes to data privacy and information security. The systems need to comply with their guidelines in order to function in the EU. Recently, the EU has introduced a set of regulations for the protection of data processing and free movement of data pertinent to natural persons residing in the EU. These regulations are known as the GDPR and are it has extraterrestrial applications. Which means that any entities processing or moving the data of the EU residents need to comply with the GDPR. This has far-reaching implications for foreign entities such as Indian companies in the data processing space.

The impact of GDPR on Indian companies is profound. The Information Technology industry in India is widespread and a large number of companies find themselves in a place where they need to comply with the GDPR to conduct transactions with the EU. So let us take a look at what Indian companies need to achieve in order to work with EU residents in the data sector.

The EU explains GDPR as, “The General Data Protection Regulation 2016/679 is a regulation within the European Union and the European Economic Area that pertains to data protection and privacy for all individuals. It also identifies and addresses the export of personal data outside the EU and EEA areas.”

Here, ‘personal data’ refers to the information related to an identified or identifiable natural persons. Which means any entity with an identification, security numbers, genetic identification, or any specific form of identification is considered a natural person. So any information pertaining to a natural person who is a resident of the EU is considered personal data under the GDPR.

For any foreign entity, such as Indian companies, dealing with the personal data of the EU residents, it is imperative to ensure that their systems are compliant with the GDPR norms and the data protection requirements are in place. This means that most Indian companies need to redefine their privacy policies and bring about certain pertinent changes in their system.

Also Read –  5 ways to remain GDPR compliant in 2019

It is not only important but lawfully stipulated that companies comply with the GDPR stipulation as the penalties for non-compliance are severe in the EU law. It can prove to be an invitation to penalties up to 10,00,000 to 20,00,000 euros or 2-4% of the global turnover of the previous financial year, whichever is higher. Most EU companies insist on  GDPR compliance  as a standard contractual clause so as to ensure complete security of their data. Indian Government is also looking at updating and introducing laws to ensure stronger data protection compliances and guidelines for Indian Companies. Meanwhile, it goes without saying that any company in India which is looking at working with the EU needs to update its data protection policies in order to continue its business transactions. Currently, the trends in the GDPR compliances beg the question of how Indian companies are preparing for this switch. For this, the following questions need to be pondered upon-

• What is the data footprint of Indian companies in EU?
• Are Indian companies equipped and prepared to provide evidence of GDPR compliances to the stakeholders who may request them ?
• Do Indian companies have a holistic understanding of what data is collected and how it is used and processed?
• Is there a defined roadmap for GDPR compliances?
• What cross border data transfer strategies are we adopting as Indian organizations?

In a recent seminar titled, GDPR: Post Implementation Review, the following points were discussed to make the compliances more relevant-

• Global Privacy Challenges: The seminar addressed global security challenges beyond GDPR and addressed the fact that while GDPR is important, it not an answer to all problems. Given the recent developments in countries like Brazil and India, the companies recognized privacy as the new normal, and decided to work to build efficient programs to address privacy challenges.
• Maintaining a Culture of Privacy Awareness: A key concern for most business is to maintain a culture of privacy in their organizations. Because of how some people view GDPR as a checklist to be completed rather than an ongoing responsibility, this concern was discussed at length.
• Territorial Scope: Various companies struggle to identify the territorial scope of GDPR given that it only applies to EU residents. However, a lot of North American businesses now abide by GDPR as a company policy rather than a mandate for EU.
• GDPR and Future Privacy Challenges: With the advent of Ai, Machine Learning and Big Data, companies have struggled to interpret the application of GDPR in the global scenario.   This discussion lead to the future challenges of GDPR that will require innovative solutions.

While this may seem like a lot of information, the right guidance can help you with these compliances. QRC solutions has a team of experts who guide and help you acquire the  GDPR certification  without much hassle.

GDPR compliance has been one of the most talked about changes over the last couple of years. Even though the deadline was in May 2018, it is obvious that investment in the compliance is a continuous process. In fact, reports even suggest that investments over the next 14 years could go up to $2.1Billion. It is also important to note the risks in case you are not compliant are quite expensive also and could be one of the reasons that many organisations are looking to implement it into their business.

So, if you are looking at getting  GDPR certification  into your business, how do you go about it? What do you have to keep in mind when you want to follow these guidelines in your company?

• Automation Technology:  Investing in automation is key for every business today, precisely because it manages costs better, improves quality and ensures consistency throughout. With mammoth data in place for most companies, you need automation to keep track of all this data. You need to know where and how the data you have can be adapted and processed – this is where artificial intelligence comes to play. You would be able to break down data so much easier and that makes all the difference to your business at the end of the day.
• Required privacy laws and data governance:  Before you look at implementing a compliance in your business, it is critical to understand why you have to implement it as well as the governing rules you need to follow. Creating a set processes of all that is done is the simplest way to implement every kind of compliance. Plus, keeping it as a mandate would only help.
• Where is your data moving?  There’s a lot being said about data lineage today and that makes perfect sense when you are implementing this kind of compliance – you need to know where your data is transformed over the course and where it is stored.
• Maintenance of data:  The main goal of GDPR certification is to ensure that any individual has control over their personal data. If your business is becoming GDPR compliant, it is important to understand what data is working towards keeping the data safe. It is vital to store the data that is absolutely important for the running of the business to keep risk away.
• Looking at the bigger picture:  You need to constantly look at the value you are getting by being compliant to GDPR – this will reduce direct costs and create an efficient audit ecosystem. You would be able to manage & track the information that is passed on throughout the system and thus be able to track and make important business decisions.

While there would be an initial investment to being your business on board – you need to look at the bigger picture and see the return on investment at every cycle. There is no doubt that a compliance of this kind will give your business a chance to thrive.