GDPR Compliance in SMEs: There is much to be done

Abstract

The obligatory adaptation of Organizations to the General Data Protection Regulation (EU) 2016/679 (GDPR), will imply a set of legal, technological and functional changes, with a direct impact on the daily life of Organizations as a result of their increased responsibility with data protection subjects that has been reinforced by the new legislation. On the other hand, the transfer of responsibilities from the national authorities to the Organizations obliges them to prove, at all times, full compliance with the legislation. Organizations are subject to heavy fines when a non-compliance is detected. This new reality is a challenge for any Organization, and in particular for small and medium-sized enterprises (SMEs), which have fewer human and financial resources to carry out the necessary measures to comply with legislation. In order to know how SMEs are preparing themselves, we have conducted face-to-face interviews with ten industrial SMEs. The main conclusion is that, given these companies' lack of awareness of their obligations and duties in relation to Personal Data Protection, it is urgent to define a methodology to be able to comply with GDPR.

The critical success factors of GDPR implementation: a systematic literature review

“…The General Data Protection Regulation (EU 2016/679), known as GDPR, is an European Union Regulation enforced from 25th May 2018 which introduces major changes regarding personal data and privacy, replacing and repealing the EU's 1995 Data Protection Directive (DPD, also known as Directive 95/46/EC) (European Commission, 2016). It is the most important alteration in the last 20 years regarding data privacy, with far greater magnitude than any similar regulation (Freitas and Mira da Silva, 2018;Allen et al, 2018), and contains obligations regarding the storing, processing, collecting and disclosing of data (Gabriela et al, 2018). With this Regulation, EU aims to give more control to citizens over their personal data, strengthening their rights, to reform how organizations view and control these data, and to remove obstacles to cross-border trades, enabling easier expansion of businesses across Europe, as well as ensuring the free movement of personal data between EU Member States (Boban, 2018;Sirur et al, 2018).…”

“…Regulations, however, have already binding legal force (Seo et al, 2018). Therefore, GDPR is applicable in every Member State without the need for a national legislation implementation, unifying the European Union rules and laws (Freitas and Mira da Silva, 2018). The Regulation has a lot of novelties, starting by the re-definition of personal data, which has been further expanded (Seo et al, 2018).…”

“…Furthermore, organizations must also be able to demonstrate compliance to Supervisory Authorities (European Commission, 2016). Besides technological challenges, GDPR also brings a lot of juridical and functional changes, along with the necessity to educate staff and change their mindset and culture to this new paradigm (Freitas and Mira da Silva, 2018). Since GDPR imposes a lot of changes and challenges, organizations will need to review their processes, routines and procedures, in order to ensure that they collect, hold and process personal data in accordance with the Regulation (Tikkinen-Piri et al, 2018).…”

“…The implementation of GDPR imposes a set of legal, technological and functional changes, having a major impact in organizations, regardless of their sector or industry (Freitas and Mira da Silva, 2018). Every organization will need to reconsider the way they collect, store and process personal data, adopt new measures and policies, and re-design internal processes to demonstrate their compliance (Boban, 2018).…”

“…Although many organizations understand the importance of complying with the new Regulation, the uncertainty around GDPR has led to some divided approaches (Sirur et al, 2018) because GDPR is not prescriptive regarding solutions to achieve compliance, not providing specific guidelines to implement its requirements (Tikkinen-Piri et al, 2018). Therefore, every organization must find and implement organizational and technological solutions to put the provisions in practice (Tikkinen-Piri et al, 2018;Freitas and Mira da Silva, 2018). For that, and to achieve compliance, it is very important to design an implementation strategy and roadmap.…”