What is the GDPR?
The GDPR is Europe's new General Data Protection Regulation that came into force on 25 May 2018. It imposes a single set of rules for the protection of personal data across the EU. Many of the GDPR's principles are the same as those in the previous EU Data Protection Directive; however, the GDPR introduced new elements and enhanced the rights of individuals in the EU regarding their personal data
Does the GDPR apply to EY?
Yes, the GDPR applies to EY member firms and other EY entities that are established in the EU. The GDPR also applies to EY entities outside of the EU to the extent that 1) they provide services directly to individuals in the EU or 2) they monitor the behavior of individuals in the EU.
How did EY prepare for compliance?
EY closely analyzed the requirements of the GDPR and implemented the required changes to bring its services in compliance by 25 May 2018, including updating client and supplier contracts and templates where appropriate.
Does EY protect my data in line with
the GDPR?
Yes, EY views the protection of your data as fundamental to doing business. We are committed to protecting information assets, personal data, and client information. For additional information, review EY's Protecting your data: EY's approach to data privacy and information security.
Is EY acting as a controller or
processor in providing services
for my organization?
Under the GDPR, the responsibilities of the parties involved in the data processing activities differ depending on their role. EY can play two main roles: a controller (the organization that determines the purposes and means of the processing) or a processor (the organization that processes personal data on behalf of a controller). For the majority of services that EY member firms provides to their clients, EY will be a controller because it exercises its own independent professional judgment, has a high degree of knowledge and autonomy in the performance of its work, and acts in accordance with its statutory, regulatory and professional obligations, rather than on the instructions of the client. The fact that EY member firms generally act as a controller in providing services to clients does not give EY unlimited rights to process client data in any manner or for any purpose. Even when they act as data controllers, EY entities must always process client data consistent with law, professional standards and the applicable client engagement agreement.
How is EY complying with the GDPR
data transfer rules?
Like the previous EU Directive, the GDPR restricts transfers of personal data outside of the EU unless the third country has an "adequacy decision" from the European Commission or the receiving entity has a valid data transfer mechanism in place. EY has developed and implemented Binding Corporate Rules (BCRs) that define EY’s policy on privacy and international data transfers. BCRs have been recognized under the GDPR as a valid data transfer mechanism. EY’s BCRs have been formally approved by data protection authorities in Europe. A copy of our BCRs is available at www.ey.com/bcr. The Court of Justice of the European Union has invalidated the EU-US Privacy Shield Framework as a mechanism for transferring personal data from the EEA to the US.  The Swiss Data Protection Authority has concluded similarly.  Nonetheless, the EY member firm in the US is committed to complying with the principles of the Privacy Shield frameworks even though it does not rely upon them to legitimize personal data transfers.
Questions
Please contact us at global.data.protection@ ey.com if you have any questions about EY’s compliance with the GDPR. About EY EY is a global leader in assurance, tax, transaction and advisory services. The Insights and quality services we deliver help build trust and confidence In the capital markets and in economies the world over. We develop outstanding leaders who team to deliver on our promises to all of our stakeholders. In so doing, we play a critical role in building a better working world for our people, for our clients and for our communities. EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. For more information about our organization, please visit ey.com. © 2022 EYGM Limited. All Rights Reserved. EYG no. 00760-183GBL 1802-2578663 ED None This material has been prepared for general   informational   purposes   only
and is not intended to be relied upon as accounting, tax or other professional isse refer to your advisors for specific advice.