Will I be fined if I ignore GDPR?

Will I be fined if I ignore GDPR – Quite simply, YES – it is extremely likely that you will attract not only a financial penalty, but you could also suffer severe damage to your company’s reputation and brand. The accountability, governance and transparency provisions defined within the regulation emphasises, extends and elevates the implicit requirements of the existing Data Protection laws. Under GDPR you are expected to implement comprehensive but proportionate governance measures. Best Practice, such as, privacy impact assessments and privacy by design become legally required after GDPR became law on May 25th 2018. These measures are designed to minimise the risk of breaches and uphold the protection of personal data. Essentially, this means organisations now have to implement more policies and procedures even if they already have good governance in place.

What is the accountability principle?

The new accountability principle in Article 5(2) requires you to demonstrate that you comply with the principles and explicitly states that this is your responsibility.

How can I demonstrate that I comply?

Rather than asking ‘Will I be fined if I ignore GDPR?’ it is far better to implement processes and working practises that will safeguard people’s personal data and reduce the risk of penalties for non-compliance. To demonstrate that you comply with GDPR you must:

1. Implement an appropriate level of technical and organisational measures that ensure and demonstrate that you comply. This is likely to include internal data protection policies such as staff training, internal audits of processing activities, and reviews of internal HR policies.

2. Maintain relevant and documentation on processing activities.

3. Where appropriate, appoint a data protection officer.

4. Implement measures that meet the principles of data protection by design and data protection by default. Measures could include: a) Data minimisation; b) Pseudonymisation; c) Transparency; d) Allowing individuals to monitor processing; and e) Creating and improving security features on an ongoing basis.

5. Use data protection impact assessments where appropriate.

You can also adopt and adhere to an approved code of conduct for your industry or market sector. A code of conduct, written by an industry body or trade association, will typically cover:

1. fair and transparent processing;

2. legitimate interests pursued by controllers in specific contexts;

3. the collection of personal data;

4. the pseudonymisation of personal data;

5. the information provided to individuals and the exercise of individuals’ rights;

6. the information provided to and the protection of children (including mechanisms for obtaining parental consent);

7. technical and organisational measures, including data protection by design and by default and security measures;

8. breach notification;

9. data transfers outside the EU; or

10. dispute resolution procedures.

Maintaining records of processing activities

In addition to your obligation to provide comprehensive, clear and transparent privacy policies, if your organisation has more than 250 employees, you are required to maintain additional internal records of your processing activities. If your organisation has less than 250 employees you are required to maintain records of activities related to higher risk processing. This includes processing personal data that could result in a risk to the rights and freedoms of individuals and processing of special categories of data or criminal convictions and offences.

What do I need to record?

You must maintain records of all processing activities because you may be required to make these records available to the relevant supervisory authority for purposes of an investigation. You must record the following information:

1. Name and details of your organisation and, where applicable, of other controllers, your EU representative and data protection officer.

2. Purposes of the processing.

3. Description of the categories of individuals and categories of personal data.

4. Categories of recipients of personal data.

5. Details of transfers to third countries including documentation of the transfer mechanism safeguards in place.

6. Retention schedules.

7. Description of technical and organisational security measures.

Don’t ask “Will I be fined if I ignore GDPR?”… ensure that your business is GDPR compliant. Contact us today for expert advice on how to avoid costly fines and reputational damage.