• It repeals, as outdated, the European Directive 95/46/EC.
• The GDPR represents an evolution of the existing EU data rules, the Data Protection Directive (DPD).
• It addresses many of the shortcomings of the DPD by adding requirements for documenting IT procedures, risk assessment under certain conditions, notification to consumers and authorities in the event of a breach, and strengthening rules for data minimization.
• One way to describe the GDPR is that it simply legislates many ideas regarding data security, minimizing the collection of personal data, deleting personal data that is no longer necessary, and restricting access to data.

• It now has extensive jurisdiction as it applies to ALL companies and organizations that process personal data.
• The terms for consent have been strengthened, and companies will no longer be able to use unreadable and jargon-filled terms and conditions, as the request for consent must be provided in an understandable and easily accessible form.
• A fine of up to 4% of the annual global turnover or up to 20 million euros (whichever is greater) can be imposed.
• It allows member states some leeway to specify their rules, including those concerning the processing of special categories of personal data (“sensitive data”).

Notification of Breach:

Under the GDPR, breach notification will become mandatory in all member states where a data breach is likely to “result in a risk to the rights and freedoms of individuals.” This must be done within 72 hours of becoming aware of the breach. Data processors will also be required to notify their customers and controllers “without undue delay” once they become aware of the data breach.

Right of Access:

As part of the expanded rights of individuals, they have the right to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, where and for what purpose. Additionally, a free copy of the personal data must be provided in electronic form. This change marks a dramatic increase in data transparency.

Removal of Notification Obligation:

The existing obligation did not sufficiently contribute to improving the protection of personal data. General notification obligations of this kind, without differentiation, should be abolished and replaced with effective procedures and mechanisms. Such processing activities may include those involving the use of new technologies.

Data Protection Officer (DPO) – Article 37:

The appointment of a DPO is necessary for the controller and the processor in every case where:

• The processing is carried out by a public authority or body, except for courts acting in their judicial capacity.
• The core activities of the controller or the processor consist of processing operations that require regular and systematic monitoring of data subjects on a large scale due to their nature, scope, and/or purposes.
• The core activities of the controller or the processor consist of large-scale processing of special categories of personal data, such as genetic or biometric data, health data, as well as data concerning criminal convictions and offenses.

The concept of “large-scale” activities includes hospitals, insurance companies, and pharmaceutical companies that may process a large amount of personal and sensitive data, such as patient health data.

Assignment & Obligations of the Data Protection Officer (DPO):

• Appointed based on professional qualifications, particularly expertise in data protection law and practices, and the ability to fulfill the duties.
• The appointment of the Data Protection Officer must be in writing.
• The Data Controller and the Processor must notify the supervisory authority of the name and contact details of the Data Protection Officer.
• The Data Protection Officer is bound by confidentiality obligations and must not disclose to any third party facts or information that came to their knowledge during the execution of their duties or on the occasion of their duties.

The Role of the Data Protection Officer (DPO):

• Primarily advisory and supportive.
• Acts as a communication link with the relevant authorities.

Taking into account the risk associated with processing operations, considering the nature, scope, context, and purposes of the processing, the Data Protection Officer must inform and advise the controller or processor regarding legislative requirements for data protection and monitor compliance with the Regulation to minimize the risk of breach. Article 38 of the GDPR states that the DPO reports to the highest management level, does not receive instructions regarding the performance of their duties, is not responsible for non-compliance of the controller/processor, and cannot be dismissed or penalized for performing their duties.

Duties of the Data Protection Officer (DPO):

• To inform and advise the Data Controller and employees who carry out processing of their obligations under the GDPR and other national or Union data protection provisions.
• To monitor compliance with data protection regulations and with the policies of the Data Controller, including the assignment of responsibilities, awareness-raising, and training of staff involved in processing operations and related audits.
• To provide advice, upon request, regarding data protection impact assessments and monitor their compliance.
• To cooperate with the Data Protection Authority.
• To act as a point of contact for the Authority on issues related to processing.

In any case, to ensure compliance with the requirements of this Regulation:

• The controller should only use processors providing sufficient guarantees, particularly in terms of expertise, reliability, and resources, for the implementation of technical and organizational measures meeting the requirements of this Regulation, including those related to processing security.
• Adherence to an approved code of conduct or an approved certification mechanism may be used as an element to demonstrate compliance with the controller’s obligations.
• Processing by a processor should be governed by a contract or other legal act under Union or member state law, binding the processor to the controller, setting out the subject matter and duration of processing, the nature and purposes of processing, the type of personal data, and categories of data subjects.