The General Data Protection Regulation (EU) 2016/679 aims to set a general frame for the protection of EU citizens’ personal data and provide a concrete context for the processing of their personal data by public authorities and private companies. The regulation not only strengthens and unifies the data protection regime for EU citizens/residents, but also defines strict principles for the transfer of personal data to third countries (outside the European Economic Area, i.e. outside the 28 EU countries plus Norway, Iceland and Lichtenstein).

Organizations, both public and private, that operate within the EU or that process EU citizens’ data, must adapt to this new reality and make sure that their operations/actions are in line with the requirements of the new regulation. The real value of GDPR is that it shifts the power over personal data from the hands of organizations, to those of natural persons. Non-compliance can be costly for all types of businesses, ranging from multi-nationals down to micro-enterprises. Severe infringements could result in a fine of up to €20 million, or 4% of the firm’s worldwide annual revenue based on the preceding financial year, whichever amount is higher. As a consequence, companies must not confront GDPR as just another legal framework that they should initially comply with and then overlook. On the contrary, they should set as a priority the cultivation/adoption of a privacy culture within their business environments and integrate data protection into all aspects of their day-to day operations, first as a mentality and then as a legality/necessary compliance measure.