8 Things Every Security Pro Should Know About GDPR

In just under one year, the European Union's General Data Protection Regulation (GDPR) will formally begin being enforced.

The statute requires any company, or entity, that handles personal data belonging to EU residents to comply with a broad set of requirements for protecting the privacy of that data. Significantly, GDPR vests EU residents with considerable control over their personal data, how it is used, and how it is made available to others. Under the statute, data subjects are the ultimate owners of their personal data, not the organizations that collect or use the data.

Companies that fail to comply with GDPR requirements can be fined between 2% and 4% of their annual global revenues or up to €20 million - which at current rates works out to just under $22.4 million USD - whichever is higher. 

Enforcement of GDPR begins May 25, 2018. It replaces Data Protection Directive 95/46 EC, a 1995 statute governing the processing and protection of private data by companies within the EU. One of its biggest benefits for covered entities is that GDPR establishes a common data protection and privacy standard for all member nations within the EU. Organizations within the EU and elsewhere will still need to deal with data protection authorities in each of the 28 member countries. But they will no longer be subject to myriad different requirements from each member nation. 

The statute was written for EU companies. But any organization, anywhere in the world that collects or processes personal data belonging to EU residents is subject to GDPR requirements. 

Surprisingly, given the specific and stringent nature of GDPR, a vast majority of U.S. companies covered under the statute do not appear to be in any particular hurry to comply with its requirements. A Spiceworks survey of 779 IT professionals from the United States, the U.K, and the EU showed that only 5% of entities in the US have started to prepare for it. While nearly one-third of all organizations in the EU are concerned about potential GDPR-related fines, barely 10% of U.S. companies appear worried that they could end up being on the wrong side of the law. 

Here's what you need to know about GDPR and what to prepare for, according to EUGDPR.org and others.