5 years of the GDPR

25/05/2023 - 25^th May 2023 marks the 5^th anniversary of the General Data Protection Regulation (fondly known as “the GDPR”) coming into effect.  If you’re reading this blog, it is likely that your LinkedIn feed, like ours, is rich with extensive accounts of how many fines have been levied under the GDPR in these five years, what loopholes exist and how the GDPR can be made even more effective. At the core of these conversations are the big-small organisations navigating the many requirements of the GDPR.

Building on the foundation set by the EU Data Protection Directive 1995, the GDPR has aimed to standardise data protection at an EU level. Over the past half a decade, the GDPR itself has continued to evolve in interpretation and scope through judgments and guidance from the CJEU and EU authorities such as the European Data Protection Board, as well as data protection authorities and courts of various member states. 

For organisations falling within the scope of the GDPR, this has meant grasping, implementing, and coping with the various facets of the law – from understanding what “personal data” is, identifying “processing activities”, determining the “legal basis”, setting up processing registers, conducting DPIAs, appointing Data Protection Officers, to keeping track of data transfers and more. Organisations have had to reinvent their processes and policies for ensuring compliance. To what extent an organisation has succeeded in this endeavour is dependent on many factors including its nature and scope of work, risk appetite, structure, and availability of resources. However, what absolute compliance with the GDPR would look like is a question for another time (or another blog?). For now, it is trite to say that GDPR compliance, in more ways than one, is not a destination but a journey – unique to every organisation involved in processing personal data.

Call to action

Since its coming into effect, a lot has been said about the GDPR’s importance for protecting personal data and privacy of individuals, and there is abundant evidence of its success in doing so. Additionally, new and upcoming laws like the Digital Services Act and the proposed Artificial Intelligence Act have also relied on the GDPR as a common baseline for regulating the digital world. In that sense, the 5^th anniversary of the GDPR marks a critical vantage point for organisations to not only prepare for the upcoming legal frameworks, but also be sure to introspect on their level of GDPR compliance as a fundamental part of that preparation.

For organisations that are already working towards complying with the GDPR, this is an appropriate time to assess the maturity of their compliance. A maturity assessment is useful in determining the existing level of compliance of an organisation. Based on the outcome of such an assessment, organisations can strategically prioritise meeting those GDPR requirements which, in the context of their business, can take their compliance to the next level of maturity.

We at Considerati offer a wide range of services to help organisations of all shapes and sizes in designing and implementing GDPR compliance strategies, including maturity assessments for organisations that intend to up their compliance game. 

To know more about our services, or if you have any questions about the GDPR, feel free to reach out.