The GDPR is a European regulation, but any firm that provides goods or services to a customer in the EU must comply. Compliance with the GDPR means that firms must:
- Inform the individual that their data will be collected and what it will be used for.
- Keep personal data for a limited time only, erasing or reviewing the data at the end of the allocated time period.
- Inform individuals of the risks, rules, safeguards and rights in relation to the processing of their data.
- Put a process in place for individuals to request access to their data, make changes or withdraw consent to use the data at any time.
- Ensure that any external data processors, such as a cloud services partner, must meet all the regulations concerning the security of the data.
- Notify individuals of a data breach, where the data is un-encrypted, within 72 hours.
- Appoint a data protection officer to ensure compliance, if employees are over 250, or customers exceed 5000 within 12 months.
For hedge funds and alternative investment firms, who have a requirement to collect personal data to adhere to money laundering regulations and guidance on investor suitability for the different vehicles that a firm offers, the GDPR will prove challenging because it allows huge fines to be levied for non-compliance. Several attendees at our spring lunch series expressed confusion and concern over this recent regulation, with many saying that they did not fully understand the requirements of the regulation. Additionally, a majority of attendees expressed that they would be looking to their in-house CTO or Compliance Officer to lead on the implementation of a data protection strategy that meets the regulations, in addition to external consultants and partners.
