GDPR

The significant difference between GDPR and its predecessor lies in the type of instruction they are. Unlike the previous policy, GDPR is not a directive. It is a regulation that legally binds
all the companies falling under its jurisdiction with stricter laws to follow. Whereas an instruction can only lay out the objectives like a guide, cannot enforce it.

According to the new law, the companies handling EU subject’s data must give importance to system design from the beginning. It should not be an add-on for the later part. Right from
the start, data controllers must pay attention to designing the system giving priority to privacy concerns

The new regulation makes consent forms more explicit for better transparency when dealing with data. There is no place for unclear and ambiguous to understand consent forms. GDPR makes it compulsory for businesses to explicitly state the facets of consent forms, making it distinguishable from other declaration forms. Also, privacy policies should be mentioned in detail and should be readily accessible to the subject. The customer should have a precise knowledge of what purpose their data will serve before being asked for consent regarding its usage.

The reach of the previous data protection direction was limited within the EU territory. Companies located in the European Union were only subjected to the directive. However, the new
law eliminates territorial boundaries and makes GDPR applicable to all data controllers and processors. As long as your company processes EU subject’s data, you are bound to comply with GDPR. Location is no more a limitation for the data protection law to apply

According to the previous directive, local Data Protection Officer (DPA) had the responsibility to record the activities of the data controllers. But with the new law, companies with large-scale data processing will have to appoint a DPO who will systematically
monitor the data processing regularly

Under GDPR, everyone is responsible for protecting data and accountable for any data breach. Earlier, it was only the data controller who was held for data misuse if any. But, now, both
the data processor and controller has to comply with GDPR to avoid mishandling of data. This means that even third-party data processors will also have to follow the compliance norms set by the new EU regulation

GDPR makes breach notification mandatory. Data controllers must inform their supervisory authority about any data breach incident within 72 hours of learning about it. Also, they must notify the subjects who are at risk due to the breach.

Article 83 of the new regulation clearly states that enterprises failing to comply with GDPR policies will have to bear heavy penalties. The penalty amount can be a maximum of 4% of the global turnover or €20 million of the previous FY, whichever will be greater. However, the fine will be on the basis of the level and the criteria of different types of non-compliance actions.Also besides fine, the company may receive warnings or suspension of their data processing license permanently.