GDPR (General Data Protection Regulation)
The European regulation governing personal data processing, with fines of up to 4 percent of worldwide turnover.
Regulation (EU) 2016/679 of April 27, 2016, the General Data Protection Regulation, has applied since May 25, 2018. It is the European reference framework for processing personal data. It imposes on organizations that collect or process such data a set of principles (lawfulness, minimization, purpose limitation, security) and gives data subjects rights: access, rectification, erasure, portability. A data breach must be notified to the supervisory authority, generally within seventy-two hours, and where appropriate to the affected individuals. Fines can reach 20 million euros or 4 percent of annual worldwide turnover, whichever is higher: a first-order financial risk. For cyber insurance the GDPR weighs heavily, because a data breach triggers at once notification costs, crisis-management expenses, a risk of administrative fine and liability claims. Whether the administrative fines themselves are insurable remains legally debated and varies by country. Some jurisdictions hold that insuring a punitive sanction would be contrary to public policy.
Textbook case: following a breach exposing the data of millions of customers, a company must notify the supervisory authority within seventy-two hours, inform the affected individuals and provision for the risk of a fine of up to 4 percent of its worldwide turnover.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.