Blog: Why You Need MFT For GDPR Compliance

Ready or not, the General Data Protection Regulation (GDPR) deadline is just around the corner.

By this point, though, if you run a company that has any connection to the European Union, you should be more than familiar. But, the fact is, many companies are not.

GDPR puts an increased burden of data security on organizations that must take responsibility for compliance. But according to a recent global survey by British market research firm Vanson Bourne, many companies are dragging their feet with compliance. Globally, 37 percent of organizations are unsure whether they need to be GDPR compliant, while 28 percent believe they don’t need to comply at all.

If your company is among the laggards or the confused, here’s why GDPR compliance should not be ignored:

GDPR is an EU order that aims to streamline the data protection regulations and strengthen data protection for all individuals affiliated with the EU. After years of discussion and preparation, the GDPR was approved by the European Parliament on April 14, 2016. And after a roughly two-year transitional period, it officially goes into effect on May 25, 2018. That currently gives companies across the world less than a year to get affairs in order.

GDPR applies to EU companies that have an establishment in the EU, provide goods and services to EU residents, and monitor the behavior of EU residents. In other words, every company in the EU is affected. Companies outside Europe also must abide by the same rules. Therefore, if a company in the United States is selling any sort of goods or services to people in Europe, that company must be sure it complies with GDPR even though it’s solely based in the U.S.

If you’re an EU citizen or simply live, work, or travel through the EU, then you and your personal data are within scope. To be clear, personal data is defined as any information related to a natural person or “data” subject that can be used to directly or indirectly identify the person. That data includes legal names, email addresses, IP addresses, photos, bank details, and medical information.

Data breaches that may pose a risk must be reported to affected individuals and to the data protection authorities within 72 hours. In case of a data breach, organizations face a hefty fine of 4 percent of annual global turnover or $21.2M ("20M), whichever amount is higher.

According to GDPR policy, part of compliance requires companies to provide some level of personal data protection. But the scope and definition of what is considered personal information are expanding.

That means the interpretation of the rules sometimes is murky, making it possible for companies to be fined for non-compliance and data breaches. Key challenges for GDPR are how to process such data, formulate contracts regarding its use and movement, and the need to demonstrate accountability, and these all require thorough documentation and reporting.

These data processes are vital since companies can’t fully control what users outside their enterprise do with the data. But by deploying a steadfast and secure system that tracks the who, what, and when of transactions, companies have the functionality and documentation required to comply.

Therefore, compliance will involve a complex combination of systems and tools, and secure managed file transfer (MFT) solutions will play an immense role. Secure data movement is an integral part every single GDPR process, from storage to analytics. Outdated file transfer solutions can’t deliver the auditing, logging, reporting, and automation that will help you comply.

MFT securely transports personal data to and from companies that must adhere to GDPR compliance using:

• Encryption of data in motion and at rest
• Non-repudiation
• Data integrity checks
• Comprehensive transfer logging
• Integration with existing security systems

A modern MFT solution provides advanced security and the control and governance you need to assure GDPR-compliant data transfers, and the clear, accurate documentary evidence to prove it.

Companies are being forced to think more about digital transformation and adapt new technologies because of GDPR. So, as the May 25, 2018, deadline looms, there is no longer room for companies to procrastinate, especially since GDPR is just the first wave of what constitutes a global re-visioning of data security and personal privacy regulation.

With modern MFT and B2B integration solutions in place, companies that must be GDPR-compliant can avoid delaying the inevitable and become an important business commodity in the globalization of data.