• Register
Return to: Home > News > Corporate Finance > EU companies late on implementing biggest shake up of data protection laws

EU companies late on implementing biggest shake up of data protection laws

General Data Protection Regulation (GDPR) will come into force in the European Union (EU) member states on 25 May 2018, affecting the way in which all organisations collect and store personal data.

GDPR will apply to any organisation (including charities) holding or processing EU personal data and it has been widely described as the biggest shake up of data protection laws for 20 years. The original Data Protection Act 1998 only placed obligations on data controllers, but the new law will also apply to data processors, which will have significant regulatory exposure for companies. The GDPR will have 80 requirements, including consent of information, and will apply to any company offering goods or services to the EU even if there is no physical presence.

All contracts involving the processing of personal data must be in writing and, in order to monitor this, businesses are required to appoint a data protection officer. According to Deloitte’s report GDPR Vision and Approach it is estimated 28,000 new data protection officers will be required in Europe. Data controllers or processors have 72 hours to report the data breach to the relevant authority.

There are a number of aspects in GDPR regulation that will take considerable time for some organisations to achieve such as governance, risk and assurance capabilities, as well as technical and data protection skills. And according to BDO legal counsel Odeline MacDonald, it is generally considered that about half of companies affected by the GDPR will not be in full compliance with its requirements by the end of 2018.

Van Havermaet (member of Morison KSi) assistant legal consultant Vincent Loenders said that accountancy firms will be required to adapt their way of working, internal organisation and security.

“Unfortunately, we have the impression that the majority of the accounting firms will be unprepared,” Loenders said. “Also we have noticed that most companies do not fully understand the importance of GDPR and the risks with regard to these new regulations. A lot of companies still think the GDPR will not be applicable to them.”

The maximum fine that the ICO can currently impose is £500,000 (USD $647,000) per breach and under the GDPR the penalties of failing to comply with the new laws could reach a maximum fine of €20m (USD $23.8m) or 4% of global turnover, whichever is greater.

Loenders said: “Very severe administrative fines can make a company go bankrupt. There is always the risk that the supervisory authority will spontaneously investigate your company, or the possibility that a dissatisfied customer or employee will file a complaint. Therefore it is quite likely that every company will be inspected at some point.”

There has been a lot of attention directed lately at the considerable fines, MacDonald explained, but companies should rather focus on the overall changes, such as the accountability of companies controlling or processing EU personal data.

“The reputational damage as a consequence of a serious privacy breach or failure is likely going to be much greater or costly,” she said.

Large multinationals have been preparing already but smaller businesses are yet to put in place the processes and expertise required. MacDonald explained that businesses will need to move from a mind-set of compliance to a mind-set of commitment, to manage data carefully and ethically. Also, GDPR demands that personal information is processed with data minimization and storage limitation.

Van Havermaet began the implementation of GDPR-specific requirements six months ago and has raised data security awareness for both clients and staff within the organisation.

Loenders commented on the process of implementation: “We charted the information flow, how the information is received, what we do with it, where we store it and with whom it is shared, resulting in a production process. We are currently cross-referencing the requirements with the steps in our production process. We will then check if we are compliant, and if not, we will adjust.”

Yet Loenders pointed out that there are not many publically available practical guides or news on how to actually implement GDPR.

“This is an intimidating challenge, and it can be difficult to know where to start. It is important that businesses, regardless of their size, get their act together and start preparing for GDPR and do not wait until May 2018,” MacDonald said.

Loenders concluded: “There isn’t much time left so if you still have to start now, you are already too late.”

Top Content

    Accountancy Europe: the winner takes it all

    Jonathan Minter spoke to Olivier Boutellis-Taft, chief executive officer at Accountancy Europe, about how technology could change the industry, and how training needs to keep up to enable the profession to develop

    read more

    Embracing global technology trends

    Accountancy Europe’s Digital Day 2018 found the European accounting profession looking to tackle the challenges presented by new technologies head on. Jonathan Minter reports from the day

    read more

    IMA Conference: automation of the audit

    At the annual conference of the Institute of Management Accountants (IMA) in Indianapolis, Deloitte partner Alex Smith gave a presentation on digital transformation in the profession. Joe Pickard spoke to Smith following the presentation to find out more about his views on the future of audit

    read more

    IMA Conference: technology and the human effect

    The annual conference of the Institute of Management Accountants (IMA) took place in Indianapolis this year. Members of the profession gathered to hear the latest from the institute and other market players, covering some of the challenges and opportunities the profession faces.

    read more

    The Caribbean: a digital paradise

    The ICAC hosted its 36th annual conference in June this year – very much looking to the future following a tough 2017 for the Caribbean. Jonathan Minter spoke with chief executive officer Misha Lobban Clarke

    read more
Privacy Policy

We have updated our privacy policy. In the latest update it explains what cookies are and how we use them on our site. To learn more about cookies and their benefits, please view our privacy policy. Please be aware that parts of this site will not function correctly if you disable cookies. By continuing to use this site, you consent to our use of cookies in accordance with our privacy policy unless you have disabled them.