The General Data Protection Regulation (GDPR) is a European Union regulation that replaced the current Data Protection Act 1998 and came into force on 25^th May 2018.

GDPR has been in development since 2012 by the European Union Parliament and the Trust to harmonise and strengthen the rights of data subject across Europe, including when data is transferred to third party countries.

The Regulation enhances the rights of individuals whose personal data is processed by an entity and allows for new changes such as the right to be forgotten and right to erasure.

It also provides for increased accountability and processes to demonstrate compliance.  For example; we may be required to either appoint a Data Protection Officer (DPO) or designate individual to take proper responsibility for the important task of data protection compliance.  Also the requirements for consent are now much higher.

All breaches will have to be reported to the Information Commissioners Office within 72 hours and the potential fines for breaches are up to €20 million.