Five Common Misconceptions About GDPR

[relemedf5w023]

After a two-year preparation period, the General Data Protection Regulation ( GDPR) officially comes into force in the European Union on May 25. InformationWeek looks at the misunderstandings that remain in the understanding of this document and discusses the principles for further work to comply with the new European standards for personal data protection.

When the GDPR was adopted and published two years ago, most organizations were horrified by its complexity, breadth of application, global impact, and unprecedented penalties. Although preparations for compliance had begun, the generality of its wording and lack of clarity in detail still leave many confused. Most organizations are accustomed to relying on a checklist of established requirements, but for the GDPR, such a checklist never materialized. Even as the new regulations begin to roll out, 27% of respondents are concerned about the obligations they face, and many of these concerns are rooted in widespread misunderstandings about the specific impacts of the GDPR on businesses.

Myth #1: Companies must ensure that personal indonesia mobile database is stored in the country of origin
Reality: Your focus should not be on the location of your data, but on its security .

There are concerns that the GDPR will force non-European companies to undertake a lengthy and expensive process of transferring data previously processed in their home countries to Europe. These concerns are unfounded. The GDPR literally states that “the transfer of personal data to and from countries outside the European Union and international organisations is necessary for the purpose of international trade and cooperation”, so it is perfectly legal for the data to be located outside the EU. However, data that has already been processed in the US, for example, does not have to be transferred to the EU. Data protection and security must be guaranteed regardless of its location. If the data remains in the US, a number of additional conditions must be met, such as compliance with model clauses or registration with the Privacy Shield, but if a company complies with the GDPR, these measures are a mere legal formality.