The General Data Protection Regulation (GDPR) aimed to strengthen the protection of personal data of citizens of the European Union (EU). The new regulation entailed a rigorous work plan to ensure that organizations were compliant with the requirements of the Regulation, whose penalties promised to be heavy for organizations.

6 months have passed since the deadline that was established, and in which the procedures of business in terms of Data Protection should be compliant with the new General Regulation. Since May 25th 2018, what has changed by now?

First and more important of all, the size of fines and sanctions are, undoubtedly, scary for business that deal with sensitive data, regardless of their size. Violating the new rules appear as a synonym as a financial suicide, so their implementation had, in fact, to be done, better or worse, sooner or later.

The quality of this implementation is a focus point; it is not possible to measure, yet, the consequences for those who saved in time, resources and €€€ to make their procedures compliant. It is true that some websites and business have shut their doors but that happened, mostly, before May 25th. What happened before that date is, still and 6 months laters, very blurred.

On the other hand, the preoccupation with sensitive data and with given permissions by the client/user has, clearly, changed, and this is even more evident when it comes to e-commerce and informative websites. We can assume, without fear, that in 6 months the online user feels more respected and involved in the amount and type of data he provides to a certain organization. The RGPD certainly contributed to this “data-awareness”.

However, there is still a long way to go, in terms of compliance with the new regulation and this is where evaluation and advisoring play their role. No GDPR compliance is accomplished without, first of all, a complete diagnosis and then, of course, without a survey of actions that meet both the business’ needs and the requirements of the new Regulation.

Investing in the area of data security and in a proper treatment of information in general must be a concern of every single company that deals with this kind of matter. And then, of course, we shall never forget: proper monitoring is key.