ENFR
Book an appointment
MenuClose
ENFR
+1 (347) 543-3035
Book an appointment
FREN
Prendre rendez-vous
MenuFermer
FREN
+1 (347) 543-3035
Prendre rendez-vous

The GDPR: how compliant are you?

In force since May 25, 2018

Our GDPR Compliance Program makes sure you comply not only with the GDPR, but also with the evolving landscape of national privacy laws and regulations in the EU Member States.

Book an appointmentDownload our GDPR brochure
27
EU Member States where it applies automatically
50+
areas left to national derogations
4%
of worldwide revenue, or €20 million: the higher fine threshold

A Regulation, not a Directive.

What is GDPR?

GDPR stands for General Data Protection Regulation, the EU legislative instrument that has, since May 25, 2018, replaced the European directive on data privacy of 1995.

Because it is a Regulation, and no longer a Directive, it is, subject to a limited number of “national derogations”, automatically applicable across all 27 Member States of the EU. It aims to simplify the European legislative framework on data privacy, which under the directive was a patchwork of European law and 28 (at the time) national laws and regulations.

The GDPR does not, however, reach the level of uniformity it set out to achieve: a number of areas remain matters for Member States to regulate at the national level, those famous “national derogations”. So companies processing the personal data of European residents need to comply with the GDPR, and also with any applicable EU countries’ privacy laws and regulations in the areas left to each Member State.

What changed on May 25, 2018.

Why you will want to comply

Seven areas where the GDPR raised the stakes for any company processing the personal data of EU residents.

  • 01

    Heavy fines

    Before

    Some countries had fines for violations of privacy laws, but these were relatively low.

    Since May 25, 2018

    The GDPR imposes fines up to the greater of 2% of the company’s worldwide revenue or €10 million, or 4% of the company’s worldwide revenue or €20 million. The thresholds vary with the nature of the breach.

  • 02

    Accountability

    Before

    Only the person responsible for the processing was accountable.

    Since May 25, 2018

    Every company processing personal data is accountable, whether it processes for itself or on behalf of another entity. Everyone who processes personal data has to keep a record of every processing operation and security breach.

  • 03

    Data breaches

    Before

    Some European countries had rules on data breaches, but they were not harmonized across the EU.

    Since May 25, 2018

    The controller has a dual notification: to the national Data Protection Authority, and to the persons concerned by the processing of their data. The processor must notify the person for whom data are being processed of any security breach.

  • 04

    Data Protection Officer

    Before

    Some European countries required companies to hire a privacy officer, but it was not consistent throughout the EU.

    Since May 25, 2018

    Appointing a Data Protection Officer (DPO) is mandatory for government entities processing personal data, for regular and systematic monitoring of individuals on a large scale, and for large-scale processing of special categories of data or data relating to criminal convictions and offenses. For other companies, a DPO can prove a valuable compliance tool.

  • 05

    Standing to sue

    Historically

    European nationals had limited standing to sue U.S.-based processors before U.S. courts.

    Now

    The Judicial Redress Act of 2015, followed by Executive Order 14086 of October 7, 2022, allows EU nationals to sue U.S. processors of EU personal data before U.S. courts. U.S. corporations with a physical presence in the EU can be sued before EU courts and, under the GDPR, even companies with no presence in the EU could be.

  • 06

    Data transfers

    Before

    After the European Court of Justice invalidated the EU-U.S. Privacy Shield on July 16, 2020, U.S. companies transferring EU personal data to the U.S. needed another mechanism, such as the EU Commission’s Standard Contractual Clauses (SCCs).

    Since July 10, 2023

    Companies self-certified under the Privacy Shield (with privacy policies updated by October 10, 2023) or the new EU-U.S. Data Privacy Framework (DPF) can freely transfer EU personal data to the U.S. Neither is enough, on its own, for the company to be compliant with the GDPR.

  • 07

    National derogations

    Before

    Under the pre-GDPR EU Privacy Directive, companies had to comply with the Directive and with 28 national privacy laws implementing it.

    Since May 25, 2018

    The GDPR is the law of the land in every EU Member State, except that in over 50 areas, the “national derogations”, Member States keep the right to add exceptions or supplemental provisions. In those areas, you comply with the GDPR and with the applicable Member State law.

How to comply, in two steps.

Compliance plan

Step 1

Pre-audit assessment of your company

We review your company’s processing practices, the types of processing performed and their purposes, and how much of the processing is done internally versus outsourced to third-party processors. We can then estimate the budget needed to carry on with the compliance plan. This step is very interactive: we need to understand who processes what, for what purposes, where, and for how long.

  • What

    • Your current privacy practices
    • Your current level of privacy compliance
    • Your internal and external data flows
    • The level of data security you have implemented

  • Who

    • Your company’s privacy decision makers
    • Who manages your information governance program
    • Your third-party processors, and their part in your processing

  • How

    • Information governance is managed
    • You secure the data
    • You keep track of your internal and external data processing

  • Where

    • The data you process is going, both internally and externally

Step 2

Audit and ongoing compliance

Based on the initial assessment and surveys, we conduct a more thorough audit of your processing operations, assessing your compliance against EU privacy laws and regulations, and draw up a privacy compliance program that fits your needs. The audit includes one or more of these tasks:

  1. 01Perform privacy impact assessments
  2. 02Inventory every contract with vendors and customers that involves data processing, and assess its compliance
  3. 03Create EU-compliant policies and procedures, including a GDPR-compliant privacy policy
  4. 04Inventory and correct all your privacy notices
  5. 05Provide internal privacy compliance playbooks, with what to include in future contracts and templates for your subcontractors
  6. 06Train you and your teams on aspects of EU data privacy law
  7. 07Make sure you meet any regulatory filing or declarative requirements
  8. 08Make sure your international data transfers comply with European laws and regulations
  9. 09Prepare you to handle an individual’s access request
  10. 10Establish processes for security breaches, or map your breach and incident response against the GDPR and plan to fill the gaps

Ongoing support, by subscription.

Going further

These optional add-on modules are only available to companies that went through steps 1 and 2, whether with us or independently.

Module

Training

Training on several parts of the regulation, adapted to your company, industry sector, business activity and processing practices, delivered monthly, every two months or on another regular basis agreed with your team.

Module

Data Protection Officer services

We can act as your externalized DPO, helping you comply with EU privacy laws from both the U.S. and the EU.

Our DPO services

Admitted in Europe and North America.

Our key differentiators

  • 01

    Dual admission

    Our admission as lawyers in Europe (the EU and the UK) and North America (the U.S. and Canada), and our professional experience on both continents, put us in a position to advise U.S.- and Canada-based companies on their operations in the EU and the UK, including how to comply with local laws.

  • 02

    Privacy law on both sides

    Our knowledge of EU/UK and U.S./Canadian privacy laws and regulations lets us help U.S. and Canadian clients comply with their obligations in both the EU/UK and the U.S./Canada.

  • 03

    Close to your operations

    Our combined physical presence in Europe and the U.S. keeps us close to our clients and their local operations, to advise them in the U.S./Canada and within the EU/UK.

Processing the personal data of EU residents?

Let’s talk about it

Book an appointment online+1 (347) 543-3035
Book an appointment
Prendre rendez-vous