The EU General Data Protection Regulation (GDPR) took effect on May 25, 2018. Potential fines for violating the GDPR include up to 4 percent of an organization's annual profits or €20 million ($23 million), whichever is greater. Despite the risks associated with failing to meet the GDPR standards, many companies are still working towards compliance.  

If you are among this group, it is critical to not give up but, rather, to focus on actively continuing efforts to achieve (and maintain) compliance.

In our first in a series of GDPR compliance action items, we look at privacy policies.

Privacy Policy Defined: Your privacy policy is the outward statement to clients and visitors to your website (and other media channels) and explains what personal information you collect, what you do with it, and with whom you share it.  

GDPR Impact: Under GDPR, your privacy policy may require updates to address GDPR notice and disclosure requirements, including those regarding an individual’s rights with respect to your data collection and use practices. This may include required and affirmative consents from users, including your use of cookies and other tracking mechanisms. Remember that GDPR applies to all data collection, including through your website and also other channels, such as mobile applications and physical data collection.

Potential Actions: Review your existing business operations and data collection practices for GDPR applicability. Where appropriate, update your existing privacy policy to address GDPR considerations. Notify users of the changes to the privacy policy and, if warranted, create a mechanism for affirmative consent to your collection practices.

Opinions and conclusions in this post are solely those of the author unless otherwise indicated. The information contained in this blog is general in nature and is not offered and cannot be considered as legal advice for any particular situation. Any federal tax advice provided in this communication is not intended or written by the author to be used, and cannot be used by the recipient, for the purpose of avoiding penalties which may be imposed on the recipient by the IRS. Please contact the author if you would like to receive written advice in a format which complies with IRS rules and may be relied upon to avoid penalties.

[View source.]