{"id":10563,"date":"2023-03-28T10:30:18","date_gmt":"2023-03-28T14:30:18","guid":{"rendered":"https:\/\/www.jumpcloud.com\/blog\/?p=8290"},"modified":"2024-08-06T10:36:13","modified_gmt":"2024-08-06T14:36:13","slug":"prepare-gdpr-compliant","status":"publish","type":"post","link":"https:\/\/jumpcloud.com\/blog\/prepare-gdpr-compliant","title":{"rendered":"GDPR Compliance Requirements"},"content":{"rendered":"\n

Organizations that collect and process personal data from EU citizens are faced with an advancing deadline to get their procedures in line with the General Data Protection Regulation (GDPR). The GDPR is the biggest change<\/a> to European Union (EU) data protection law since the 1995 EU Data Protection Directive.<\/p>\n\n\n\n

The GDPR expands the scope of companies that need to comply, strengthens data subject rights, and raises the bar for security and privacy. Some of the new rights EU citizens have with respect to their personal data is the right to erasure and data portability. GDPR has a global scope and applies to any organization that processes personal data, regardless of its size.<\/p>\n\n\n\n

You may find this page of the GDPR regulation<\/a> helpful if you are not familiar with some of the GDPR terminology. Otherwise, read on to find out why the law was created, its basic tenets, the basic rights of EU citizens under GDPR, steps to compliance with GDPR, and what JumpCloud is doing to meet these requirements and fulfill all of its obligations under the law.<\/p>\n\n\n\n

What Is GDPR?<\/h2>\n\n\n\n

GDPR is a landmark data protection law<\/a> that was introduced by the EU in May 2018 to regulate the collection, use, storage, and sharing of personal data. Significantly, it places no limits on where the data processing occurs. Its main objective is to increase transparency and introduce accountability for organizations that are custodians of data. <\/p>\n\n\n\n

GDPR applies to all organizations that process personal data of EU citizens, including businesses of all sizes, nonprofits, and government agencies. Organizations that fail to comply with the GDPR can face fines<\/a> and reputational damage. Enforcement is broad: Amazon was assessed a \u20ac746 million fine<\/a> in 2021 while small businesses<\/a> that are found to be in violation of the law often pay anywhere from few hundred to several thousand euros.<\/p>\n\n\n\n

Main Goals of GDPR<\/h2>\n\n\n\n

The main goal of GDPR is to protect and strengthen individuals’ right to privacy and ensure that organizations process personal data in an accountable, secure, and transparent manner.<\/p>\n\n\n\n

EU citizens (and many people beyond its borders) now have more control over their personal data, including the right to access, correct, and delete what has been collected about them. Small and medium-sized enterprises (SMEs) must provide clear privacy notices and obtain consent from customers before they gather any personal information about them. <\/p>\n\n\n\n

Strong enforcement is built into the law, which introduced substantially higher penalties for noncompliance. EU supervisory authorities were granted significant new powers to enforce data protection laws, including a broad authority to impose fines.<\/p>\n\n\n\n

The EU also used the law to smooth regulations among its member states into a strong, unified framework. The law does provide for the free flow of data between EU members and third countries, but data transfers are subject to conditions. As a result, SMEs must identify and manage multi-jurisdictional retention requirements when they store data among cloud service providers.<\/p>\n\n\n\n

\n

Organizations of all sizes must be prepared to invest in GDPR. Keeping records and data within compliance, creating organizational policies and controls, conducting training, and developing human resources are foundational activities. An identity management platform is an important system to achieve compliance by controlling employees\u2019 personal data.<\/p>\n<\/blockquote>\n\n\n\n

Which Organizations Does GDPR Apply To?<\/h3>\n\n\n\n

GRPD applies to organizations of all sizes and all types that are:<\/p>\n\n\n\n

Based in the EU<\/strong>: Any organization that\u2019s based in the EU that processes the personal data of EU citizens is subject to the law. There\u2019s no getting around it: the rules apply whether the processing takes place within or outside the EU.<\/p>\n\n\n\n

Based outside the EU<\/strong>: Any organization that processes the personal data of EU citizens is subject to the law, regardless of where it\u2019s based. That association is not solely defined by a direct customer relationship: any party that\u2019s part of monitoring consumer behavior is involved. <\/p>\n\n\n\n

Data controllers and processors<\/strong>: An organization that collects data and uses it for a marketing promotion such as an animal shelter holding names and addresses in a database for a fundraiser is considered to be the data controller<\/strong>. It may hire a printing company to send out invitations, which makes the printer a data processor<\/strong>. Any data processor that handles personal data on behalf of a controller is subject to GDPR, regardless of its location.<\/p>\n\n\n\n

Every organization that\u2019s subject to GDPR must comply with its requirements, including obtaining consent for data processing, implementing appropriate technical and organizational measures to protect personal data, and providing individuals control over their data. The next section outlines the rights of EU citizens in greater detail and what information is involved.<\/p>\n\n\n\n\n

\n
\n \"JumpCloud\"\n <\/div>\n
\n

\n The IT Manager\u2019s Guide to Data Compliance Hygiene <\/p>\n

\n How to ace your audit <\/p>\n <\/div>\n

\n Get the Guide <\/a>\n <\/div>\n<\/div>\n\n\n\n\n

Information Protected Under GDPR<\/h2>\n\n\n\n

So, what type of information would an organization that controls or processes data have to look out for?<\/p>\n\n\n\n