Who does it apply to?

The General Data Protection Regulation (GDPR) applies to all organisations that collect and use personal data in connection with their business or statutory activities carried out within the European Union. Every business is required to implement the relevant regulations, regardless of its sector, size or legal form – international industrial groups, sole traders, public institutions, non-profit organisations, etc. Both businesses and entities that process personal data on their behalf, such as accountancy firms and transport companies, must comply with the Regulation.

The GDPR must be implemented where:

• the company processes the data of natural persons, e.g. customers, patients, employees, job applicants, but also contractors who are natural persons (e.g. sole traders),
• the natural persons whose data is being processed are located within the EU (their nationality is irrelevant),
• the business operates within the EU, regardless of the location of the company’s head office and the place where customers’ personal data is processed,
• the company processes the data of natural persons from outside the EU, but has its head office within the EU.

Information about the Regulation

The GDPR is Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. All Member States are required to comply with it. In Poland, the provisions on personal data protection based on the GDPR are regulated by the Act of May 10, 2018, published in the Journal of Laws 2018, item 1000.

The GDPR contains general guidelines regarding the proper protection of personal data—maintaining its confidentiality, integrity, and availability to authorized persons—but does not specify concrete security measures. The measures implemented in individual companies should be selected based on an individual risk analysis. In practice, data security systems in organizations—often with very similar profiles—can differ significantly from one another. In every case, however, the fundamental objectives of the GDPR must be achieved:

• effective protection of individuals’ personal data under changing conditions (technological, organizational, etc.),
• ensuring the free flow of personal data within the EU by guaranteeing uniform law,
• equipping individuals (as well as supervisory authorities) with tools to effectively respond to GDPR violations.

The GDPR requires businesses to:

• developing appropriate measures to protect personal data,
• documenting the processing of personal data,
• monitoring breaches and notifying supervisory authorities, as well as the individuals affected by the breach (i.e. those at risk of their data falling into the wrong hands), within 72 hours of such an incident occurring,
• appoint a Data Protection Officer (this applies to organisations where data processing forms the basis of their business).

Under the GDPR, individuals have gained:

• unrestricted access to information regarding what data a business holds about them and to what extent it processes it,
• the ability to correct their data, transfer it or even have it completely deleted.

Benefits of implementation

Implementation of the GDPR is the responsibility of every entity that processes the personal data of natural persons. Failure to comply with the provisions set out in the Act may result in a financial penalty of up to 4% of the company’s annual turnover, as well as significant reputational damage. It is therefore advisable to seek the support of specialists to develop a GDPR-compliant personal data protection system for your organisation.

As part of a professional GDPR implementation, a business gains, amongst other things:

• a record of activities related to the processing of personal data,
• procedures for risk analysis and risk management should a risk arise,
• ongoing supervision of its personal data protection system,
• the opportunity for continuous improvement of the personal data protection system,
• contract templates tailored to their business activities for consent to the processing of personal data.