GDPR Compliance: What It Means for Your Business

Recently, the European Union has enacted a series of regulations collectively known as the General Data Privacy Regulation (GDPR) concerning the use and security of user data. If your company handles data from customers or clients within the European Union, these regulations must be followed very closely: even if you are not based within the EU, you can be punished substantially for breaking any statute. In this article we will summarize the requirements of the new law, and how your business software can help you adjust your current workflow to its mandates.

 

What Does GDPR Mean for Me?

The GDPR, while ratified in May 2016, just went into effect May 2018, giving companies time in advance to adjust to the new regulations. If your company processes, collects, or makes decisions using the personal data of users within the EU, you are required to do the following:

  • Receive clear consent from your users. Your users must agree to any collection and use of their data, and they must understand how you intend to use it. This means writing Terms and Conditions in plain English and making it simple to opt out of any potential data collection.
  • Give users prompt notice if their privacy is breached. If your databases or any computer system containing personal data has been compromised, you must inform all users within 72 hours of the breach’s discovery.
  • Grant users Right to Access. Users can request to know exactly what you are doing with their data, and why, and receive a digital copy of any information you have collected on them.
  • Grant users the Right to be Forgotten. Users can request you not only delete their data from your server, but remove it from any databases and ongoing third-party processing.
  • Provide data portability. Users must be able to download their data from your servers in an easy-to-process format that can potentially be uploaded to another service.
  • Offer Privacy by Design. Your business systems must be designed to protect users’ personal privacy by only taking the data you need, and ensuring that it will only be used by the people who need it.
  • Utilize Data Protection Officers. If manipulating large amounts of user data is a key part of your business, you will need to hire an independent data protection officer (DPO) to ensure the data is being kept secure and private.

The consequences for breaking these rules can be potentially catastrophic for your business. If you are found to have broken one of these requirements, the European Union can fine your company up to 20 million Euros, or four percent of your total revenue—whichever value is higher. If you continually disregard these regulations, you may be prevented from operating within EU borders.

How Do I Maintain Compliance?

While the process of getting your business in line with these regulations might seem daunting, having a software solution with built-in privacy protection functionality can simplify it drastically. One example is Microsoft Dynamics 365 Business Central, Microsoft’s newest ERP solution. This cloud-designed system provides many tools throughout the program to manage and protect personal data, as well as quickly report breaches or other privacy violations. Microsoft also provides many resources to help you better understand the GDPR and Business Central’s privacy protection features.

Microsoft Dynamics GP, the company’s mature and comprehensive solution, already implements privacy by design, a key facet of the GDPR regulations: the program contains many tools to manage and monitor personal data, including audit trail reporting to know who sees what data and export capabilities. Microsoft also disabled telemetry gathering for Dynamics GP, ensuring your personal data remains private.

Sage Intacct, one of the best-in-class accounting solutions on the market, also can help you achieve GDPR compliance. As of Sage Intacct 2018 Release 2, the program provides a data obfuscation tool to ensure account data remains private throughout your accounting workflows. Learn more here.

Need Some Help?

Cargas has been helping businesses manage and protect their data for 30 years. Our skilled consultants can help you make sure your company’s systems protect your user’s privacy, whatever the industry or location. We’d love to answer any questions you have about GDPR and how it affects your business. Contact us to schedule a consultation.