In an era of rapid digitization and globalization, protecting privacy and personal data has become one of the key challenges facing the modern world. In response to the growing threats associated with unauthorized access and data processing, the European Union introduced the General Data Protection Regulation (GDPR).

What is GDPR?

The General Data Protection Regulation (GDPR) is an EU law aimed at protecting the privacy and personal data of European Union citizens, thereby increasing their security. The new regulations came into effect on May 25, 2018, and have become crucial for companies and organizations processing personal data, including the IT sector.

What falls within the scope of the GDPR?

• Entities: This applies to all organizations that process the personal data of individuals located in the European Union. This includes companies, government organizations, and non-profit institutions, whether based in the EU or outside it, if they offer goods or services to individuals in the EU or monitor their behavior.
• Personal data: Includes any information relating to an identified or identifiable natural person, such as name, address, telephone number, email address, online identifiers, location data, biometric data, genetic data, health data, and any other information that can identify an individual.
• Processing activities: This refers to all personal data processing operations, such as collecting, storing, using, modifying, sharing, deleting, and destroying data, regardless of the methods and technologies used.

It is the responsibility of every employer to adapt GDPR procedures so that they are compliant with European Union requirements(!)

GDPR Obligations:

• Documentation and records of processing activities – organisations must maintain detailed documentation of data processing, including information such as the purpose of processing, categories of data, recipients of data and security measures used to protect data.
• Data Protection Impact Assessment (DPIA) – Carrying out data protection impact assessments: Where processing is likely to result in a high risk to the rights and freedoms of natural persons, organisations must carry out a data protection impact assessment.
• Security measures – implementing appropriate technical and organisational measures: Organisations must ensure that personal data is processed securely by applying appropriate technical (e.g. encryption) and organisational (e.g. security policies) measures.
• Data Breach Reporting – Reporting Breaches to the Supervisory Authority: Organizations are required to report personal data breaches to the relevant supervisory authority within 72 hours of detection, unless the breach does not pose a risk to the rights and freedoms of individuals. Informing Data Subjects: If the breach is likely to pose a high risk to the rights and freedoms of individuals, organizations must also inform them without undue delay.
• Appointment of a Data Protection Officer (DPO) – organisations that process data on a large scale, monitor individuals on a large scale, or process special categories of data must appoint a Data Protection Officer (DPO) who will be responsible for overseeing compliance with the GDPR.
• Privacy by design and default: Organizations must implement data protection measures already at the design stage of new processes, systems and services (privacy by design) and ensure default data protection so that data is protected at the highest level without the need for additional action on the part of the data subject (privacy by default).
• Training and awareness raising – employee training: Organisations must provide regular training to their employees to increase their awareness of personal data protection and GDPR principles.
• Data Processing Agreements – Entering into Agreements with Data Processors: Organisations must enter into data processing agreements with data processors on their behalf to ensure that processing is carried out in accordance with the GDPR.
• Responding to data subject requests – exercising data subject rights: Organizations must be prepared to respond to data subject requests for access, rectification, erasure, restriction of processing, data portability and objection to processing.
• Auditing and Monitoring Compliance – Regular Compliance Audits: Organizations should regularly audit and monitor the compliance of their data processing processes with the GDPR to identify and correct any potential breaches.

Summary

Personal data protection is a set of principles and practices designed to ensure the privacy and security of information relating to individuals. It protects all data that can identify an individual, such as name, address, telephone number, email address, social security number (PESEL), as well as biometric and genetic data.

The primary legal act regulating personal data protection in the European Union is the GDPR (General Data Protection Regulation), which entered into force on May 25, 2018. The GDPR imposes obligations on organizations regarding the storage, processing, and transfer of personal data and provides individuals with a number of rights, including the right to access, rectify, and delete their data.

The purpose of protecting personal data is to prevent abuse and violations of privacy and to ensure that data is processed lawfully, fairly and in a transparent manner for the data subject.