The General Data Protection Regulation (GDPR) will come into force in the European Union (EU) in May 2018 to meet current challenges related to personal data protection and to harmonise data protection across the EU. Although the GDPR is anticipated to benefit companies by offering consistency in data protection activities and liabilities across the EU countries and by enabling more integrated EU-wide data protection policies, it poses new challenges to companies. They are not necessarily prepared for the changes and may lack awareness of the upcoming requirements and the GDPR's coercive measures. The implementation of the GDPR requirements demands substantial financial and human resources, as well as training of employees; hence, companies need guidance to support them in this transition. The purposes of this study were to compare the current Data Protection Directive 95/46/EC with the GDPR by systematically analysing their differences and to identify the GDPR's practical implications, specifically for companies that provide services based on personal data. This study aimed to identify and discuss the changes introduced by the GDPR that would have the most practical relevance to these companies and possibly affect their data management and usage practices. Therefore, a review and a thematic analysis and synthesis of the article-level changes were carried out. Through the analysis, the key practical implications of the changes were identified and classified. As a synthesis of the results, a framework was developed, presenting 12 aspects of these implications and the corresponding guidance on how to prepare for the new requirements. These aspects cover business strategies and practices, as well as organisational and technical measures. Transfer of personal data to third countries or international organisations Corresponding articles in DIR95: Principles (Article 25) and derogations (Article 26)  New conditions for personal data transfers: BCRs, approved code of conduct and approved certification mechanism are new means of appropriate safeguards for personal data transfers to third countries or international organisations.
For example, Tikkinen-Piri et al. REF compared the GDPR with the DPD95 with the aim of analyzing their differences and identifying GDPR's practical implications, specifically for organizations providing services based on personal data.
EU General Data Protection Regulation: Changes and implications for personal data collecting companies
Computer Law & Security Review
Computer Science