AUGUST 2018CIOAPPLICATIONSEUROPE.COM8IN MYOPINIONT he General Data Protection Regulation (the "GDPR") came into force on 25 May 2018. Although a two years grace period was granted to data controllers for complying with the GDPR, it was only at the week of the May 25th that we saw our mailboxes full with new privacy policies drafted in accordance with the GDPR. These last minute privacy notifications did not come as a surprise; the GDPR introduced new obligations which required most businesses to readjust their processes and new challenges to overcome. Business in and outside of the EU (due to the expanded territorial scope) are continuing their efforts to comply with the GDPR and getting assistance from law firms, IT firms, data management firms and also from new technological solutions to overcome the challenges of the GDPR. This article intends to briefly examine some of these challenges and some of the solutions adopted by the business to comply with the GDPR. Data Inventory If a business wants to comply with the GDPR, the first thing that it needs to do is to be aware of its personal data activities. For that purpose, businesses prepare a personal data inventory showing the activities where personal data is processed, the purpose and the legal basis of the processing, the data subject category, recipients of data, transfers abroad, etc. Data inventories are particularly important for the accountability obligation under the GDPR. The GDPR sets forth high accountability standards. This is very important especially for the data controllers and processors which are not used to complying with complex privacy rules. In a nutshell, the accountability standards under the GDPR require the data controllers and processors to be able to demonstrate their compliance with the GDPR. It may seem a straightforward obligation but it is not. It would be very difficult, if not impossible, for a data controller to comply with this obligation without having an organized view of its data processing activities. This is where the data inventories come into play in this regard; they enable the businesses to have a control over their processing activities. Data inventories are useful for the observation of data transfer activities as well. Data transfers outside European Economic Area are regulated under the GDPR. The GDPR does not want the personal data to be transferred to third countries unless certain specific conditions are met. The reason behind this restriction is to avoid the undermining of the level of protection provided by the GDPR when the personal data is transferred to third countries. Data inventories show the countries where the data is transferred and therefore enable the businesses to keep a tab on their data transfer activities. There are various other uses of data inventories, though preparing a data inventory is not an easy task. In practice, businesses require the assistance of lawyers and/or IT and data management consultants for preparation of data inventories. There are also newly developed software for preparation of data inventories. There are quite a number of businesses which prefer to employ these new technological tools to prepare data inventories. The features of these tools may differ; some of The GDPR: Challenges and SolutionsOZAN KARADUMAN, PARTNER, GÜN + PARTNERS
< Page 7 | Page 9 >