TO WHOM DOES THE GDPR APPLY?
Before going berserk on GDPR- ask yourself first, whether & to what extent GDPR applies to you. The concept of GDPR will apply to you if your organization
is acknowledged within the EU, you are handling data on individuals in the EU with whom you want to do business or if you are tracking the behavior of
individuals in the EU. This simply put states that, all major organizations across the globe must be GDPR compliant or risk the penalties.
There are also two distinct types of data-handlers the GDPR applies to- Data Controllers & Data Processors.
Data controllers are the individuals, public authority, agency or other bodies which, alone or jointly with others who supervise & are accountable for
gathering & using personal data. It’s important for you to understand whether these regulations apply to your organization as a whole, as these data
controllers come with great legal responsibilities.
Data processors are individuals, public authorities, agencies or other bodies which, alone or jointly with others who process personal data on behalf
of the controller. Examples include accounting or payroll management companies.
The distinction is important because under GDPR, a controller will hold most of the liability if the organization experiences a breach while the
responsibility of a processor is making sure all the controllers they work with are GDPR compliant.
At the core of GDPR lies the concept of personally identifying information & any personal data, which is defined as “information relating to an identified
or identifiable natural person ‘data subject’,” is in the extent of the regulation. But however, GDPR does not apply to data that “does not relate to an
identified or identifiable natural person or to data rendered anonymous in such a way that the data subject is no longer identifiable.”
“Pseudonymization”- is one of the top ten operational impacts of the GDPR in European data protection law. Pseudonymization refers to the disconnection
of data from direct accessories so that the linkage to an individual’s identity is impossible without the additional information that’s held separately.
Hence, pseudonymization can notably reduce the risks that’s associated with data processing, while maintaining the data’s utility. For this to happen,
GDPR also devises incentives to pseudonymize the data that they gather.
Even though pseudonymization is suggested it shouldn’t be used to split up identifiers from the data subjects concerning privately identifiable information
in order to circumvent other commitments. What marketers should keep in mind is that pseudonomyzed information comes under GDPR and it is meant for decreasing
the risk of data subject, not some inside trick to bypass other rules.