The EU General Data Protection Regulation (“GDPR”) standardized and set guidelines for the collection and processing of personal data, requiring businesses to protect the personal data and privacy of European Union (EU) citizens. Following Brexit, the UK has retained the GDPR into domestic law, which is now called UK GDPR.
Considered one of the strictest privacy laws in the world, the GDPR imposes obligations on any organisation that collects data about individuals in the UK (or the EU)002C even if a company is outside the UK (or EU.) Organisations must not only be mindful of how and what information is collected, they also need to document procedures used to safeguard data, be transparent about security measures, and ensure that sufficient adequate data processing agreements are in place.
The data the GDPR protects includes personal information that relates to an identified or identifiable individual, such as a name, address, and/or ID numbers, as well as web data such as location, IP address, cookie data, and RFID tags. ‘Special Category’ Information is also protected, including health, genetic, and biometric data, religious beliefs, membership in a trade union, political opinions, racial or ethnic data, and sexual orientation/practices: the GDPR prohibits the processing of special category data unless certain provisions are in place.
At the heart of the GDPR is the importance of privacy rights of individuals, especially in this digital age where almost everything about an individual is shared and stored online. The regulations attempt to give people, whether they are customers, clients, patients, or employees, more control over their data while outlining how organizations should collect, store, and use that data.