On May 25th, 2018 the General Data Protection Regulation came
into effect. The GDPR, as it's known, aims to protect the
fundamental privacy rights of data subjects in a world increasingly
driven by data. It puts greater requirements on companies who
collect and process personal data, to ensure individuals understand
what's happening with their data and consent to its use, if
necessary. It applies to all companies processing the personal data
of data subjects residing in the EU, regardless of where the
company is located.
Even before the GDPR, when your company collected personal data
from individuals, you needed to notify them of how their data will
be used. This was usually done through a privacy policy. It's
goal was to explain clearly to individuals what you will do with
their information. Under the GDPR, the requirements for privacy
notices expanded. A key objective of these requirements is to
provide more transparent and accessible information to data
subjects
