• Register
Return to: Home > News > EU companies late on implementing biggest shake up of data protection laws

EU companies late on implementing biggest shake up of data protection laws

General Data Protection Regulation (GDPR) will come into force in the European Union (EU) member states on 25 May 2018, affecting the way in which all organisations collect and store personal data.

GDPR will apply to any organisation (including charities) holding or processing EU personal data and it has been widely described as the biggest shake up of data protection laws for 20 years. The original Data Protection Act 1998 only placed obligations on data controllers, but the new law will also apply to data processors, which will have significant regulatory exposure for companies. The GDPR will have 80 requirements, including consent of information, and will apply to any company offering goods or services to the EU even if there is no physical presence.

All contracts involving the processing of personal data must be in writing and, in order to monitor this, businesses are required to appoint a data protection officer. According to Deloitte’s report GDPR Vision and Approach it is estimated 28,000 new data protection officers will be required in Europe. Data controllers or processors have 72 hours to report the data breach to the relevant authority.

There are a number of aspects in GDPR regulation that will take considerable time for some organisations to achieve such as governance, risk and assurance capabilities, as well as technical and data protection skills. And according to BDO legal counsel Odeline MacDonald, it is generally considered that about half of companies affected by the GDPR will not be in full compliance with its requirements by the end of 2018.

Van Havermaet (member of Morison KSi) assistant legal consultant Vincent Loenders said that accountancy firms will be required to adapt their way of working, internal organisation and security.

“Unfortunately, we have the impression that the majority of the accounting firms will be unprepared,” Loenders said. “Also we have noticed that most companies do not fully understand the importance of GDPR and the risks with regard to these new regulations. A lot of companies still think the GDPR will not be applicable to them.”

The maximum fine that the ICO can currently impose is £500,000 (USD $647,000) per breach and under the GDPR the penalties of failing to comply with the new laws could reach a maximum fine of €20m (USD $23.8m) or 4% of global turnover, whichever is greater.

Loenders said: “Very severe administrative fines can make a company go bankrupt. There is always the risk that the supervisory authority will spontaneously investigate your company, or the possibility that a dissatisfied customer or employee will file a complaint. Therefore it is quite likely that every company will be inspected at some point.”

There has been a lot of attention directed lately at the considerable fines, MacDonald explained, but companies should rather focus on the overall changes, such as the accountability of companies controlling or processing EU personal data.

“The reputational damage as a consequence of a serious privacy breach or failure is likely going to be much greater or costly,” she said.

Large multinationals have been preparing already but smaller businesses are yet to put in place the processes and expertise required. MacDonald explained that businesses will need to move from a mind-set of compliance to a mind-set of commitment, to manage data carefully and ethically. Also, GDPR demands that personal information is processed with data minimization and storage limitation.

Van Havermaet began the implementation of GDPR-specific requirements six months ago and has raised data security awareness for both clients and staff within the organisation.

Loenders commented on the process of implementation: “We charted the information flow, how the information is received, what we do with it, where we store it and with whom it is shared, resulting in a production process. We are currently cross-referencing the requirements with the steps in our production process. We will then check if we are compliant, and if not, we will adjust.”

Yet Loenders pointed out that there are not many publically available practical guides or news on how to actually implement GDPR.

“This is an intimidating challenge, and it can be difficult to know where to start. It is important that businesses, regardless of their size, get their act together and start preparing for GDPR and do not wait until May 2018,” MacDonald said.

Loenders concluded: “There isn’t much time left so if you still have to start now, you are already too late.”

Top Content

    Brexit negotiations: Making simple complicated

    Stepping away from the politics, ACCA UK head John Williams talks about the practical implications of Brexit for businesses’ supply chains and how the accountancy profession’s pragmatism could be a welcome. But, when it comes to Brexit, by its very nature, the politics can’t stay away for too long. Interview by Vincent Huck.

    read more

    TA & IAB 2017 Awards: Prem Sikka granted the Editor's award

    Accounting professor Prem Sikka will receive a special editor’s award from The Accountant and International Accounting Bulletin at a one-day conference and awards dinner in London on 4 October

    read more

    Australia country survey: scandals and struggles

    CPA Australia hit the headlines over excessive pay, bad management, intimidation, and a ‘celebrity’ CEO departing with a generous payoff. After a parliamentary inquiry and an independent review due to report, can determined members get the CPA they want? Tom Ravlic reports

    read more

    Technical brief: Kazakhstan

    To what extent has Kazakhstan acted on the world bank’s recomendations from a decade ago?

    read more
Privacy Policy

We have updated our privacy policy. In the latest update it explains what cookies are and how we use them on our site. To learn more about cookies and their benefits, please view our privacy policy. Please be aware that parts of this site will not function correctly if you disable cookies. By continuing to use this site, you consent to our use of cookies in accordance with our privacy policy unless you have disabled them.