Complying With GDPR

GDPR is a new regulatory law, the acronym for General Data Protection Regulation, approved and adopted by the EU Parliament on April 14, 2016 and provides a higher standard of protection and privacy of personal data for citizens of the European Union. The new regulation spells out a long list of security obligations and requirements that organizations must now follow in order to protect and secure private data. GDPR is a new regulation to reform and replace the existing Data Protection Directive which was the former standard since 1995.

This new regulation has been in the works for more than 4 years by members of the European Union intending to give all EU citizens better control over their personal information in today’s digital world. GDPR goes into full effect after a 2-year grace period, and provides strong fundamental rights to citizens in order to protect their information. Any organization that is found in non-compliance after the enforcement date of May 25, 2018 could face massive fines, along with other serious and painful repercussions for organizations that mishandle information, or who are held responsible for a privacy data breach.

Given the very nature of today's digital world, GDPR not only affects organizations within the European Union. It also affects any organization around the world that collects, transfers, or processes personal data of any European Union citizen, including the United States and the United Kingdom, regardless of whether the UK "Brexits" from the European Union or not.

Written into the language of GDPR are certain rights for EU citizens to seek damages if an organization is found responsible for the mishandling, unauthorized collecting, or being the cause of a breach of their personal data regardless of their location.  It adds specific new responsibilities that organizations must now follow in order to ensure that personal data remains inextricably secure even if business necessitates it to transfer from location to location.

As a result, EU organizations could actually begin refusing to do business with outside firms if they feel there might be even the slightest risk, especially if companies are unaware of GDPR, or unwilling to demonstrate compliance. This is why it would be sensible for organizations everywhere to prepare for this new regulation.  They simply can’t afford to ignore GDPR. 

GDPR encourages expansion of international trade and cooperation across borders as a necessary part of commerce, but also recognizes the importance of securing personal information of EU citizens around the world. As a result, GDPR requires that where organizations from third countries may be involved with personal data of EU citizens, or who manage EU data, those organizations must also comply by GDPR security standards regardless of there location.

EU organizations that conduct business with third countries outside the EU are responsible to ensure that the organization they are doing business with complies with GDPR, and these third-party organizations must be able to demonstrate that they are in full compliance of GDPR.

As the regulation indicates, "(101) ...A transfer could take place only if, subject to the other provisions of this Regulation, the conditions laid down in the provisions of this Regulation relating to the transfer of personal data to third countries or international organizations are complied with by the controller or processor."

Kanguru makes it easy to comply with GDPR requirements by providing robust data security products and services. Kanguru's flexible, scalable solutions help organizations of any size fully maintain a high-level of security for sensitive data under any budget. Call us today to discuss how Kanguru can help you build a secure data environment to meet your needs.

GDPR Requires A Data Protection Officer
· Kanguru Remote Management Console (KRMC)

GDPR Requires Personal Information of EU Citizens be Protected from Beginning to End
· Defender AES 256-Bit Hardware Encrypted Drives
· Remote Management
· Self Service Password Management
· RSA-2048 Digitally-Signed Secure Firmware
· Customization Including engraving for Contact Information, Logos, Serial Numbers, Unique Electronic Identifiers & more
· Physical Write Protect Switch
· On-Board Anti-Virus Scanning

GDPR Requires that Technology Integrates Security by Design and Default
· Automatic Encryption
· Automatic, Multi-Level Protections

GDPR Recommends Certifications and Code of Conduct
· FIPS 140-2 Certifications
· Common Criteria Certification
· NIST Standards

GDPR Gives EU Citizens the "Right to Erasure" & "Right to Be Forgotten"
· Secure Data Erase on Select Duplicators
· Erase Outdated Data from HD, SSD and USB