European Union Privacy Law Basics
Europe was facing issues of privacy and data protection since decades. Now, the European Union (EU) has introduced a comprehensive privacy law called the General Data Protection Regulation (GDPR). Under this law, if your business collects, stores, or uses personal information about European residents, then the GDPR can have an intense impact on your business processes.The Data Protection Directive is a European Union directive established in the year 1995 which regulates the processing of personal data within the European Union which is now replaced by GDPR, which aims primarily to give control back to citizens and residents over their personal data. GDPR was adopted on April 27, 2016. And after two years, It becomes enforceable from 25 May 2018.
There Are some Specific Key Terminologies
- Data Subject: A primary key of identification through which one can easily be identified either directly or indirectly like the name of a person.
- Personal Data: An information which is related to data subject like age, address, phone no.
- Sensitive Personal Data: Personal data which is related to genetic or bio-metric etc. like Copy of fingerprints and retinal scan.
- Processing: Anything which is done by using personal data like storing, transferring, sharing, modifying, deleting of personal data.
- Controller: Controller specifies the purpose of processing the personal data.
- Processor: Process the personal data based on the instructions as per controller.
- Pseudonymous Data: A personal data that cannot relate to a specific data subject without additional information that is stored separately, with technological measures to ensure the data is not combined with that additional information.
- Anonymous Data: Data that cannot ever be connected to an identified or identifiable person.
GDPR enforce rules for how companies, governments, and other entities can process the personal data of data subjects who are in the EU.
Some key changes that GDPR brings upon are as follows
- A basis for data processing
- Compliance obligations
- Breach notification
- Data protection officer
- Enforcement
- Use of processors
- Profiling
- Data subject rights
- One-stop-shop
Some Key Principles Found In GDPR
- Fairness and Transparency
- Purpose Limitation
- Data Minimization
- Accuracy
- Data Deletion
- Security
- Accountability
Individual Rights
There are several numbers of rights that have been granted by GDPR to data subjects regarding how controllers handle their data.
- Data Access
- Right to Object
- Data Rectification
- Restriction of Processing
- Data Portability
- Right to Erasure
GDPR consider as an important step by Salesforce to move forward in streamlining data protection requirements across Europe. We’ve worked closely with European lawmakers, EU data protection authorities, and industry associations throughout the development and approval of the GDPR.
It’s been hard for Salesforce customers to rely on Salesforce to make sure that if they are in compliance with GDPR. Any organization subject to the GDPR can take steps to ensure it is compliant with the law. So what can organizations do?
- Get Buy-in and Build Your Team
- Assess Your Organization
- Establish Controls and Processes
- Document Compliance
There are multiple questions, choices, and complex analyses come into the path of compliance with GDPR. It’s a long but interesting journey, and an organization must undertake with executive support and guidance from knowledgeable internal and external partners. It’s also one of the fundamental right to protect our personal data.
Thanks For Reading!!
Happy Salesforce!!
Blog References: CI Security, Salesforce Trailhead
