The definition of personal data has been broadened and the interpretation includes any piece of data that could be used to identify a natural person (for example, an IP address or GPS location).

The GDPR requires organizations to produce adequate risk assessments and reviews of their data processing footprints or private information supply chain to ensure that their systems and processes adhere to the spirit of the GDPR.

Data privacy breach incidents need to be handled in such a way that the relevant supervisory authority needs to be informed within 72 hours of awareness of the breach and include the depth and exposure of the incident.

The GDPR applies to data controllers and data processors whether they reside within the EU or not, going beyond what is covered by the current data protection laws. It has implications for organizations that outsource their data processing to countries outside of the EU.

The GDPR refers to states outside the EU as "third countries." The Data Protection Board will determine if each third country has adequate data protection regulations to be compatible with the GDPR.

A company outsourcing their data processing (or otherwise) to an organization in a third country will need to ensure that adequate protection and processes in the organization are in place to comply with GDPR. In so doing, the third country must also support and be compatible with the GDPR.

The individual need not worry about the GDPR as it applies to businesses rather than individual persons. It also only applies to the personal data of living natural persons.

Does this matter to the UK with Brexit?
The question of whether Brexit affects the UK's GDPR stance is moot. Ostensibly, the possible timing of the UK leaving the EU will still mean that the UK will still need to adhere to the GDPR as the earliest the UK will leave the EU is 2019, well after the GDPR is adopted.

Even so, the GDPR has been regarded as the gold standard by which a digital economy should operate with respect to privacy of data and its exchange. Industry experts have suggested that as the UK is a leading digital economy, being founded on a strong finance industry, that adherence to the GDPR naturally will be embraced. The UK Government has reinforced that sentiment by working on an EU transition bill, the Grand Repeal Act, which will incorporate the current EU legislation to reduce the costs and effects of sudden change out of Europe.

The GDPR is written, as you would expect, in terms of the European Union, its bodies and processes. There are a few explicit exceptions where it is incompatible with member state legislation. Effectively outside of the EU, the UK will be a third country in terms of the GDPR. To properly adopt the GDPR post-Brexit, there needs to be a UK version of the GDPR that is compatible with the processes of the EU GDPR. One likely scenario is to appoint a supervisory authority (such as the ICO) to maintain the UK version of the GDPR as both a UK Data Protection Board but also a recognized supervisory authority to the EU Data Protection Board.

Organizations like the British Computer Society would like to see data protection equivalence with the EU a minimum standard (see note 2), with an opportunity for the UK to become a world leader in this area of legislation (note 8), possibly having even stronger laws of protection (note 9).

In summary, any company based in the UK will still need to comply with the GDPR when it processes personal data belonging to EU citizens. Furthermore, it will be subject to similar UK legislation for processing personal data of a UK citizen post-Brexit.

What happens if the GDPR is breached?
The ICO has the power under the current data protection legislation to investigate UK institutions for personal data breaches and can fine institutions up to £500,000 for breaches that are not handled correctly.

When the GDPR comes into force, the potential fines are much larger. The financial penalty will be at least 2% of the global revenues for the business (or €10 million if higher). In comparison to some actual fines given by the ICO, the increase in penalties will be substantial -- see Table 2.

Therefore, it is critical that businesses have adequate controls in place on the personal data they manage and, in the event of a breach, that they have effective processes in place to report breaches to the appropriate authorities.

Call to action
Businesses should consult with specialists who deal with assessing risks and identifying gaps in their security and private data management processes. The models of operation are complex and profuse; they need to be understood and applied to the specific business: e.g. understanding the roles of Controller and Processor.

For a relatively new business or new project involving personal data, the security and risk to personal data must be considered from day one with systems and processes developed with the GDPR "built in." Existing businesses will need to assess their Information Systems stack and retro-fit changes to ensure that the integrity and privacy of personal data is guaranteed.

Here are some key points that need to be considered:

Risk assessments -- Organizations are required to undertake risk assessments against processes and systems that involve "high-risk" processing of personal data. Here, "high risk" is defined in terms of the rights and freedoms of the individual being violated.

GDPR certification -- As the GDPR comes into play and the approach to it matures in the market, there will be the opportunity to certify organizations compliance with it, much in the same way as businesses certify compliance with ISO27001 and other standards.

Enhanced Consent of the individual -- Ensure that systems asking for consent do so in plain language and that they allow the subject to withdraw consent as easily as giving it. Ensure that processes support consent on personal data whilst providing information on recipients, processes and risks to the data subject at a granular level and that existing systems are changed to support this.

Clear documentation of the nature of personal data held -- an organization must understand what personal data it holds, how it processes it and who the recipient is.

Relationships with partners who provide third-party services must be reviewed to ensure that the services are GDPR-compliant, particularly in countries outside of the EU.

Be ready to respond to breaches -- Organizations must develop robust processes to handle breaches of personal data compatible with the agreed timelines specified in the GDPR.

Adequately budget for data projects and supporting tools. The expectation is that there may be fundamental business processes that are relatively straightforward to adopt. However, one should consider that dealing with the data itself and incorporating new tools will take significant effort.

Responsible Parties -- An organization of over 250 employees, whose line of business involves the regular processing of personal data, must have a Data Protection Officer who can act independently and with authority on data issues.

References/Notes
1. https://business-reporter.co.uk/2014/12/19/companies-face-being-fined-5-of-turnover-if-they-suffer-sony-style-hack-in-future/
2. http://www.bcs.org/content/ConWebDoc/56850
3. https://www.dwf.law/news-events/legal-updates/2013/01/sony-fined-for-data-protection-breach/
4. http://www.bbc.co.uk/news/technology-21160818
5. https://www.statista.com/statistics/279269/total-revenue-of-sony-since-2008/
6. https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2016/10/talktalk-gets-record-400-000-fine-for-failing-to-prevent-october-2015-attack/
7. https://en.wikipedia.org/wiki/TalkTalk_Group
8. http://www.bcs.org/content/conBlogPost/2578
9. http://policy.bcs.org/content/digital-brexit-planning-successful-digital-future-outside-eu

— Stephen Cameron is an Information Management and Digital Strategy Leader working in the Financial Industry. He is the author of a successful and authoritative book Enterprise Content Management, A Business and Technical Guide (ISBN 978-1906124670, BCS 2011), a BCS Fellow and a Chartered Engineer.

— Chris Pinnock is an IT Consultant working in the Telecommunications Industry. He holds a PhD in Mathematics, is a BCS Fellow and a member of the BCS ELITE IT leadership group.