While the final arrangements for reform to EU Data Protection laws are still under negotiation, there are some areas that businesses can address now to minimise the burden of compliance when the new framework comes into place. There is no time like the present to start the preparation and all businesses, including start-ups, should start to consider some of the following areas:
What does my company do with data?
Under the reform more stringent controls are being put in place for the control and use of a variety of types and processes involving data – with this in mind companies should start the process of an internal audit on the data they hold and use. Some of the areas to focus on could include the type of data they use (are they sensitive?), the purpose, how long the data are kept, and storage and transfer issues.
Establishment
For businesses operating in a number of countries, it will be key to consider where you are established under the new rules – considering who is your home or host controller?
Internal Management
Whose job is it within the company to manage data and the processes involving data – the new framework puts in place stringent requirements on this element. You should also consider whether you are now a processor or a controller of the data, and what your process is in the circumstance of a data breach or loss.
Transfers and storage
Start to think about how the data is stored and transferred, does it remain in the EU or do you use a cloud service?
How can you put a plan in place?
Every business needs to put in place a compliance plan – there are potentially a couple of years before application of the new rules, however by then compliance may have become a costly and substantial burden.
And finally…
Can you afford not to comply? As the rules currently stand fines can be imposed of up to 5% of global revenue! Image Credit: MPD01605, Flickr