Great confusion, many questions and equally great insecurity, anxiety and concern are caused by the advent of the General Data Protection Regulation (GDPR) for small and medium-sized enterprises, including insurance intermediaries.

What is personal data? What is the difference between personal and sensitive data? What constitutes the processing of personal data? Who is affected by the GDPR and which businesses are required to comply with it? What steps should businesses follow in order to achieve compliance with the Regulation? Are small and medium-sized enterprises obliged, or not, to have a DPO? Will fines start being imposed immediately with the application of the Regulation in 25 May, or will there be a period of ...grace?

Let us briefly look at some interesting information

Who is affected by the GDPR

The General Data Protection Regulation applies to all public bodies and all companies without exception (even if they are established outside the EU) and which process the personal data of European citizens.

It applies to the controllers of such data as well as to those processing it on behalf of the controllers.

It applies to data kept both in paper form and electronically.

So, if a business processes personal data of employees, customers, suppliers, if it keeps their e-mail in a physical or electronic file, if it communicates with its customers electronically for the purposes of presenting and promoting its products, or if it manages group insurance policies for its staff, it is obliged to comply with the Regulation.

How ready are businesses?

As stated by EY executives, in a survey they conducted, only 1/3 of companies at pan-European level state that they are ready to comply with the Regulation.

A large percentage are not even aware of its existence, another has heard of it but do not know how to handle its requirements, and a third think they know and assign the preparation process to the wrong department.

What was stressed, therefore, is that the Regulation concerns all departments of a company and all should be involved in the preparation and compliance process.

But what happens when it is a small business of two three or ten people, or a sole proprietorship? How easy is it for them to comply with the regulation?

Compliance steps

Let us define the steps that must be followed:

First of all, the issues arising from the Regulation should be understood.

To create a support team or to hire a DPO (mandatory only in large businesses).

To record the data and the procedures that must be followed, the systems and the files (physical and digital) that contain them.

To carry out an analysis of the gap in compliance with the Regulation.

There should be design and/or redesign of the appropriate data flows policies and of the processing carried out, so that the body or company is able to monitor and create a record-keeping system.

Employees should be made aware, so that a relevant culture is formed both within the business and in relation to customers.

And finally, in the event of a data breach, they must notify the Data Protection Authority within 72 hours and then their customers.

Fear of fines and lawsuits

Fines in the event of non-compliance will be proportionate to the size of the business. They will reach up to 20 million euros or 4% of the organisation’s global annual turnover, whichever is greater.

In the initial period, fines are not expected to be imposed, but only recommendations will be made by the Authority and it will be monitored whether businesses are progressing with the compliance procedures.

However, we should be cautious as regards the grace period and not become complacent. Not so much because of the fines that will be imposed as because of the blow that the business’s reputation will suffer in the event of a data breach, but also because of any civil liabilities that may be raised.

The fear of lawsuits from customers, employees or suppliers of a business, in the event of a data breach or if they consider that the collection and processing of data concerning them was not carried out lawfully, is evident. For this reason, as was emphasised, it is very important to place particular emphasis on companies obtaining the consent of data subjects for the possession and processing of their personal data.

The positive side

The benefits that may arise for a company that protects (and proves that it protects) the personal data it holds are considerable. Compliance will help it:

  • to achieve better organisation and make its systems more secure,
  • to strengthen its customers’ trust.

to preserve its reputation.

to gain a competitive advantage over its competitors.

See more information here

See more information here .