The General Data Protection Regulation – in short Overview Applicable as of 25 May 2018 Protects data on natural persons (customers, employees, contact persons etc.) Protects all types of personal data (name, address, email, phone number, CV, salary, purchase history, arrears etc.) Re-enacts almost all the current rules in the Danish Data Protection Act and introduces new requirements at the same time Game changer: Penalty by fine significantly increased (up to EURm 10-20 or 2-4% of the annual global revenue) A good reason – and occasion – to thoroughly review how you handle personal data Focus areas Legal basis for processing, e.g. consent, contract with the data subject or balancing of interests Deletion rules Obligation to provide information to data subjects Data subjects’ rights, e.g. the right to access personal data Third parties and data processing agreements IT security (who can access data etc.) Adaptation of IT systems to handle and support new requirements Establishment of process documentation