Data Protection Regulation: Compliance Starts Today

The requirements imposed by the General Data Protection Regulation 2016/679 ("GDPR") entail extensive work for undertakings processing personal data under the threat of heavy administrative sanctions (up to 4% of worldwide annual turnover or EUR 20,000,000, whichever is higher). This concerns data controllers (i.e. legal or natural persons who determine the purposes and the means of the processing) as well as data processors (i.e. legal or natural persons who process the data on behalf of the controller and upon his instructions). It also involves a profound change in the approach to personal data processing within businesses. For the accountability duty towards the authorities that will be of paramount importance to all concerned, this will affect their corporate internal organisation - starting next year on 25 May 2018.

The accountability principle means that the controller must comply with the GDPR. It also means that it must be able, at any time, to demonstrate such compliance to the competent authorities and notably to prove that all personal data it processes is under control, mapped, secured, lawfully transferred and only used for determined purposes in accordance with the GDPR.

Even though the prior filing of formalities with the Commission Nationale pour la Protection des Données ("CNPD") will be abandoned under the GDPR, controllers will have to meticulously document and monitor their data processing-related activities, notably by conducting impact assessments, i.e. in-depth analysis of the processing, where required. The management of the processing must be internalised rather than declared to the CNPD. Under the GDPR, these obligations will also, to a certain extent, be incumbent on data processors with respect to the data that they process on behalf of a controller under a servicing agreement. Until the GDPR applies, only the controllers are responsible for complying with the data protection law.

Given the extent of the task incumbent on controllers and processors, which starts with the identification of (i) the type of personal data that is processed, (ii) the data subjects, (iii) the legal grounds, (iv) the purposes of the processing, (v) the recipients of the data transfers and the guarantees for the data subjects, (vi) the retention period, (vii) the security applied, etc., it is essential to start planning the roadmap today in order to be prepared for and compliant with the GDPR when it becomes effective.

As a starting...