Deeper Dive: Security Incident Notification Under The New EU General Data Protection Regulation (GDPR)

As noted in the 2017 BakerHostetler Data Security Incident Response Report, the enactment of the EU General Data Protection Regulation (GDPR) represents the most significant change in European data protection law in more than 20 years. Coming into effect on May 25, 2018, the GDPR focuses on a number of core data protection principles and includes provisions relating to fair, lawful, and transparent data processing; data minimization and purpose limitation; data integrity and accuracy; specific data retention periods; increased data security; and accountability associated with the practices of data controllers and processors.

Among the key operational impacts of the GDPR is a new "personal data breach" notification obligation, the first EU-wide requirement to notify supervisory authorities and affected individuals of security incidents. Organizations doing business in the U.S. that are familiar with federal and state security breach notification requirements likely