The General Data Protection Regulation 
  Long awaited EU-wide data 
  protection law is now applicable
          GDPR  | Introduction
          Introduction
                      th
          May 25 ... A defining day in Privacyland. As I write, the long-awaited 
          introduction of the General Data Protection Regulation is upon us. 
          And what a busy time the run-up to this day has been! My team has 
          been supporting many, many organisations as they geared up their 
          data policies and practices to comply with GDPR. From performing gap 
          assessments and running transformation programmes to advising on 
          governance issues. I am really proud of my team and what we have 
          achieved together. 
          Tried, tested and new                                         Catching up
          A snapshot of organisations today would show varying          In the past year, through articles, blogs and vlogs, our 
          degrees of GDPR-readiness. Some are very well                 team has shared a vast amount of relevant information 
          prepared, but there is room for surprises, as we do not       with the public on privacy-related issues. We have now 
          know how exactly GDPR will be enforced in practice.           brought them together in this magazine, as an easy way 
          Some organisations still have some ground to cover.           for our clients to catch up. But developments do not 
          And there are some still at the very start of their           stop here, nor will we. I am really looking forward to the 
          journey. Deloitte will continue to provide them all with      next season in Privacyland!
          our tried and tested GDPR services. 
                                                                        Annika Sponselee
          But we are now entering a new reality for organisations, 
          with new needs. And Deloitte is ready to respond. One         Annika Sponselee is Deloitte’s Global Solution Leader for 
          new factor is regulatory enforcement: organisations           GDPR and the Hub leader for GDPR in North-West Europe 
          must deal with questions from supervisory authorities         (Netherlands, Belgium, Switzerland , UK, Ireland and the 
          on their handling of personal data, and may even see          Nordics), where Deloitte has 150 dedicated privacy 
          inspectors visit their premises. Deloitte now has a           professionals. In the Netherlands, she heads a team of over 
          rapid-response team on hand to help them.                     25 seasoned experts with legal, security, IT and compliance 
                                                                        backgrounds.
          Reaping the benefits
           But the compliance side of things is just part of the 
          story. Deloitte is equally focused on the opportunities 
          that GDPR brings. The real emphasis of our new 
          services, therefore, is on helping organisations reap the 
          benefits of their data.
          The new regulations have forced organisations to 
          create order in the information they have. And order 
          provides insight. Insight into value that was hidden 
          there. Deloitte is here to help organisations explore 
          the business potential of their data sets, and be their 
          partner in new ventures. Could privacy excellence even 
          become an organisation’s Unique Selling Point?
          02
     GDPR  | Introduction
     The General Data 
     Protection Regulation 
     (GDPR) promises data 
     protection rules that 
     will remove red tape 
     for businesses but 
     also tighten privacy 
     protections for online 
     users. 
     02
                                                                                                  GDPR  | Content
                      Content
                      The General Data Protection Regulation                                        04
                      The GDPR: Areas of Attention & Practical Guidance                             08 
                      The GDPR World Series
                                                                                                    12
                      Privacy seals, certifications & marks possibilities  
                                                                                                    14
                      The future of i
                                nternational data transfers 
                                                                                                    16
                      GDPR and the impact on cloud computing  
                                                                                                    18
                      GDPR & Brexit: Is there a need for an adequacy decision? 
                      GDPR Top Ten Series 
                                                                                                    22
                      #10   One stop shop  
                                                                                                    24
                      #9    Security and breach notification  
                                                                                                    26
                      #8    Pseudonymization and its use in profiling  
                                                                                                    28
                      #7    Data Protection Authority enforcement methods 
                                                                                                    30
                      #6    Privacy by Design and by default  
                                                                                                    32
                      #5    New Data Subject Rights  
                                                                                                    34
                      #4    Maintaining records of processing activities  
                                                                                                    36
                      #3    Extraterritorial applicabi
                                              lity of the GDPR  
                                                                                                    38
                      #2    Accountability principle  
                                                                                                    40
                      #1    Data Portability  
                      GDPR & Industries
                                                                                                    42
                      GDPR: controller/processor guarantees 
                                                                                                    45
                      GDPR Impact on Financial Services 
                                                                                                    47
                      GDPR: a consumer product and retail perspective 
                                                                                                    49
                      GDPR in the public sector 
                                                                                                           03