The new GPRD should be taken into account by all companies that operate with data of citizens of the European Union, regardless of whether they have their headquarters in other regions or countries.

The five keys to understanding the new Regulation are the following:

Sanctions against abuses

The EU will impose large fines on those responsible for the use of data without knowledge of the users or illegally obtained that can reach 20 million euros or up to 4% of its annual turnover, the highest amount.

Clear consent

Companies must request express consent to use personal information. And it is not enough to present a tiny and illegible text: you have to make clear and concise the use that will be given to your data and what data it will contain.

Report incidents

The law imposes a maximum of 72 hours to inform a customer that their account has been pirated or that there is a risk with your information.

Registration in the internal files and record of activities

The new GPRD replaces the obligation to register the files in the Spanish Agency for Data Protection for having a record of internal activities. With the implementation of the new regulation, each responsible company will have to describe in detail what data it collects, with what purpose it treats it, to whom it communicates it, if it transfers it to third countries, how it preserves its security and when it will be able to suppress it.

Right to cancel

All platforms must have a button available in which, in a simple way, you can unsubscribe or request the deletion of your data.

A data delegate

All digital platforms of a certain size must provide users with a «data protection delegate», who can be presented with claims