With 2018 just around the corner and the European Union setting a clock on raising the standards of personal data protection, companies are starting to prepare themselves for new challenges.

The General Data Protection Regulation (“GDPR”) approved by the EU in 2016 will enter into force on the 25th of May 2018 and all companies processing personal data need to be compliant by that time.

As compared to the current Romanian legislation which sets reasonable administrative fines and measures, the GDPR ensures that non-compliance is not an option by allowing the National Privacy Authority to impose fines up to 20 million Euros or 4% of group worldwide turnover (whichever is greater) against both data controllers and data processors.

But this is not all. Along with a harsher sanctioning regime, the GDPR introduces new obligations for businesses and extends the rights of the individuals.

I. Does your company need to implement the GDPR?

GDPR applies to companies processing any information related to an identified of identifiable person, whether they are data controllers or data processors. From small businesses to multinational enterprises, personal data processing is part of the normal business activity: employees’, clients’ and contractual partners’ personal data processing, the use of online cookies, marketing campaigns and so on. Therefore almost each and every company falls under the GDPR requirements.

II. Which are the main changes?

The relevant changes from a business perspective are the following:

III. GDPR compliance project

Taking into consideration the short period of time left for implementing all the above changes, if you have not yet updated your procedures, the best time to start complying with the new regulation is now.

In order to ease the process, we will weekly analyse one specific change considering the GDPR provisions, the available national and European guidelines available so far and also the proper way to put them into practice.