Recent years have given rise to a significant increase in cybercrime and data breaches, particularly following the fallout of the 2008 global financial crisis (GFC). In the wake of economic uncertainty that followed, citizens and businesses became especially vulnerable to financial fraud and criminals took advantage.
The stark increase in criminal activity prompted governments to enact stricter regulations regarding personal data, resulting in privacy initiatives like the California Consumer Privacy Act (CCPA) in the U.S. and the General Data Protection Regulation (GDPR) in Europe. These initiatives are aimed at giving individuals control over their personal data and providing a more clear and streamlined regulatory environment.
The regulations help protect against the theft or misuse of personal data that can result in identity theft, financial fraud, and other criminal activity. Since its introduction, the number of reported data breaches have more than doubled, but critics believe the cost and complications involved with implementing GDPR has negatively affected capital funding for small to medium-sized businesses (SMBs).
GDPR Compliance
The General Data Protection Regulation (GDPR) was adopted in 2016 and came into power on May 25, 2018, replacing the outdated Data Protection Directive of 1995. It defines stringent practices that organisations must enact to safeguard the personal data of residents of the European Union (EU) and European Economic Area (EEA).
It requires that all businesses that process the personal information of EEA residents enact ‘appropriate technical and organisational measures’ to protect the data they hold. This involves a variety of techniques, including anonymization where necessary, encryption of data, and following strict rules regarding the use of information.
Following the initial introduction of GDPR compliance regulations, it was required that all entities storing personal information of customers must receive written permission from the individual in order to continue storing the data. Organisations are required to keep thorough documentation of all events related to GDPR compliance, including any data breach or evidence of an attempted breach.
All data breaches must be reported to a Data Protection Authority (DPA) within 72 hours of of discovery unless the breach is deemed unlikely to result in a risk to exposed individuals. In the event of a high-profile breach deemed likely to present significant risk to individuals, the breach must be reported immediately.
When is GDPR Applicable
GDPR regulations apply if any party involved in the relationship is based within the EEA, including the data controller (the business or organisation), the processor (a third-party data processor or service) or the data subject (individual customers or clients). This means that any company that deals with EU residents, irrelevant to its geographical location, is subject to GDPR regulations including all the associated responsibilities, penalties, and liabilities.
Law enforcement and National Security agencies are exempt from the regulations, along with all digital household or personal relationships such as non-professional email correspondence. The regulations are loosely defined as being applicable to any transaction that involves an economic element and is therefore considered a business relationship.
Third-party Risks
When running a business and dealing with customer data, it is often necessary to share personal client data with third-party processors. Many companies use third-party service providers for backup and storage, or intermediaries to facilitate credit checks, payments, or other business operations. In these cases, you are forced to trust a third-party provider with the highly sensitive personal information of your customers, opening yourself up to risk.
Surveys have shown that in the event of a data breach, the majority of customers will place full blame on the company, even if a third-party is proven to be responsible. As the sole entity to which your customers have entrusted their data, you are required to take full responsibility for how it is used going forward.
To this end, it is of the utmost importance that strict due diligence is carried out on all third-party processors that your company is in business with. You cannot run the risk of falling foul to the embarrassment and reputational shock of a public data breach, as such instances often spell the beginning of the end for a company.
With the introduction of GDPR requirements, companies are now even more likely to be held accountable for any leaks or mismanagement of personal data. Regulators have become particularly harsh with penalties, especially if you can’t prove that strict due diligence procedures were carried out.
Due Diligence Planning
Conducting appropriate and efficient due diligence requires careful planning which can be done in house or through a third-party intermediary. Most large corporations will have a department dedicated to the implementation, management and continued reassessment of due diligence procedures.
In the event of large-scale data processing, criminal information processing, or processing by a public authority, it is required that the organisation appoint a Data Protection Officer to oversee GDPR requirements.
The implementation of an effective due diligence plan can be broken down into several stages.
- Stage 1 - Development of a strategy for the management of third-party relationships.
- Stage 2 - Draft shortlist of potential third-party candidates for a specific function.
- Stage 3 - Conduct due diligence procedures on all potential candidates.
- Stage 4 - Negotiate and draft legal agreements for the chosen candidate.
- Stage 5 - Conduct subsequent due diligence procedures and re-evaluate the situation on a periodic basis.
- Stage 6 - In the event of failed compliance, terminate the relationship and restart the process.
For small to medium-sized businesses, it is often more cost effective to outsource your due diligence requirements to a professional third-party agency that deals in compliance procedures.
With a well-implemented and effective due diligence plan, GDPR compliance needn't be a concern for most businesses.
For more information on GDPR compliance and due diligence, give us a call today on +357 25 346630 or email info@cedar-rose.com