{"id":466,"date":"2017-06-07T11:27:29","date_gmt":"2017-06-07T11:27:29","guid":{"rendered":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/industry\/2017\/06\/07\/understand-gdpr\/"},"modified":"2018-11-22T15:20:50","modified_gmt":"2018-11-22T15:20:50","slug":"understand-gdpr","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2017\/06\/07\/understand-gdpr\/","title":{"rendered":"Helping you and your organisation understand the GDPR"},"content":{"rendered":"<p>.ac-container{margin-left:40px;}.ac-container &gt; div{position:relative;}.ac-container label{\tcursor: pointer;         font-size: 2em;         font-weight: 300;         line-height: 1.2em;         margin: 15px 0;         padding-top: 20px;         color: #0066b9;}.ac-container input:checked + label,.ac-container input:checked + label:hover{\tbackground: #c6e1ec;\tcolor: #3d7489;\ttext-shadow: 0px 1px 1px rgba(255,255,255, 0.6);\tbox-shadow:\t\t0px 0px 0px 1px rgba(155,155,155,0.3),\t\t0px 2px 2px rgba(0,0,0,0.1);}.ac-container label:after,.ac-container input:checked + label:after{\tcontent: &#8221;;\tposition: absolute;\twidth: 32px;\theight: 32px;\tleft: -40px;\ttop: 30px;\tbackground: transparent url(&#8216;https:\/\/az370354.vo.msecnd.net\/wordpress\/2017\/06\/down-arrow.png&#8217;) no-repeat center center;}.ac-container input:checked ~ label:after{\tbackground-image: url(&#8216;https:\/\/az370354.vo.msecnd.net\/wordpress\/2017\/06\/up-arrow.png&#8217;);}.ac-container input{\tdisplay: none;}.ac-container article{\toverflow: hidden;\theight: 0px;\tposition: relative;\tz-index: 10;\ttransition:\t\theight 0.3s ease-in-out;}.ac-container input:checked ~ article{\ttransition:\t\theight 0.5s ease-in-out;}.ac-container input:checked ~ article.ac-medium{\theight: auto;}<\/p>\n<section class=\"ac-container\">\n<div>\n<label for=\"ac-1\">What is the GDPR?<\/label><\/p>\n<article class=\"ac-medium\">The General Data Protection Regulation (GDPR) is the European Union\u2019s new data protection law. It replaces the Data Protection Directive, which has been in effect since 1995. While the GDPR preserves many of the principles established in the Directive, it is a much more ambitious law. Among its most notable changes, the GDPR gives individuals greater control over their personal data and imposes many new obligations on organisations that collect, handle or analyse personal data. The GDPR also gives national regulators new powers to impose significant fines on organisations that breach the law.<\/article>\n<\/div>\n<div>\n<label for=\"ac-2\">When does the GDPR take effect?<\/label><\/p>\n<article class=\"ac-medium\">The GDPR takes effect on 25th May 2018. The GDPR actually became law in April 2016, but given the significant changes some organisations will need to make to align with the regulation, a two-year transition period was included. Organisations should not expect any grace period from regulators beyond 25th May 2018. \u00a0Some EU member state regulators have already gone on record to say there will be no enforcement holiday for organisations that fail to comply.<\/article>\n<\/div>\n<div>\n<label for=\"ac-3\">What are the main requirements of the GDPR?<\/label><\/p>\n<article class=\"ac-medium\">The GDPR imposes a wide range of requirements on organisations that collect or process personal data, including a requirement to comply with six key principles:<\/p>\n<ul>\n<li>Transparency, fairnesss and lawfulness in the handling and use of personal data. \u00a0You will need to be clear with individuals about how you are using personal data and will also need a \u201clawful basis\u201d to process that data.<\/li>\n<li>Limiting the processing of personal data to specified, explicit and legitimate purposes. \u00a0You will not be able to re-use or disclose personal data for purposes that are not \u201ccompatible\u201d with the purpose for which the data was originally collected.<\/li>\n<li>Minimising the collection and storage of personal data to that which is adequate and relevant for the intended purpose.<\/li>\n<li>Ensuring the accuracy of personal data and enabling it to be erased or rectified. You will need to take steps to ensure that the personal data you hold is accurate and can be corrected if errors occur.<\/li>\n<li>Limiting the storage of personal data. You will need to ensure that you retain personal data only for as long as necessary to achieve the purposes for which the data was collected.<\/li>\n<li>Ensuring security, integrity, and confidentiality of personal data. \u00a0Your organisation must take steps to keep personal data secure through technical and organisational security measures.<\/li>\n<\/ul>\n<\/article>\n<\/div>\n<div>\n<label for=\"ac-4\">Does the GDPR apply to my organisation?<\/label><\/p>\n<article class=\"ac-medium\">The GDPR applies more broadly than might be apparent at first glance. Unlike privacy laws in some other jurisdictions, the GDPR is applicable to organisations of all sizes and all industries. Specifically, the GDPR applies to:<\/p>\n<ul>\n<li>processing of anyone\u2019s personal data, if the processing is done in the context of the activities of an organisation established in the EU (regardless of where the processing takes place);<\/li>\n<li>processing of personal data of individuals who reside in the EU by an organisation established outside the EU, where that processing relates to the offering of goods or services to those individuals or to the monitoring of their behaviour.<\/li>\n<\/ul>\n<p>The EU is often viewed as a role model on privacy issues internationally, so we also expect to see concepts in the GDPR adopted in other parts of the world over time.<\/p>\n<\/article>\n<\/div>\n<div>\n<label for=\"ac-5\">How do I know if the data that my organisation is processing is covered by the GDPR?<\/label><\/p>\n<article class=\"ac-medium\">The GDPR regulates the collection, storage, use, and sharing of \u201cpersonal data.\u201d Personal data is defined very broadly under the GDPR as any data that relates to an identified or identifiable natural person. \u201cPersonal data\u201d includes any data that relates to an identified or identifiable individual. This can include data such as online identifiers (e.g., IP addresses), employee information, sales databases, customer services data, customer feedback forms, location data, biometric data, CCTV footage, loyalty scheme records, health and financial information and much more.<\/article>\n<article class=\"ac-medium\"><\/article>\n<article class=\"ac-medium\">Indeed, the term is so broad that it can even include information that does not appear to be personal \u2013 such as a photo of a landscape without people \u2013 where that information is linked by an account number or unique code to an identifiable individual. And even personal data that has been pseudonymized can be personal data if the pseudonym can be linked to a particular individual.You should also be aware that the processing of certain \u201cspecial\u201d categories of personal data \u2013 such as personal data that reveals a person\u2019s racial or ethnic origin, or concerns their health or sexual orientation \u2013 is subject to more stringent rules than the processing of \u201cordinary\u201d personal data.<\/article>\n<\/div>\n<div>\n<label for=\"ac-6\">My organisation is only processing data on behalf of others. Does it still need to comply with the GDPR?<\/label><\/p>\n<article class=\"ac-medium\">Yes. Although the rules differ somewhat, the GDPR applies to organisations that collect and process data for their own purposes (\u201ccontrollers\u201d) as well as to organisations that process data on behalf of others (\u201cprocessors.\u201d) This is a shift from the existing Directive, which applies primarily to controllers.<\/article>\n<\/div>\n<div>\n<label for=\"ac-7\">What risks does my organisation face if it does not comply?<\/label><\/p>\n<article class=\"ac-medium\">For the last several decades, European privacy laws have generally not included significant fines for breaches. That will change dramatically under the GDPR. The maximum fine for serious infringements will be the greater of \u20ac20 million or four percent of an organisation&#8217;s annual global revenue. In addition, the GDPR empowers consumers (and organisations acting on their behalf) to bring civil litigation against organisations that breach the GDPR.<\/article>\n<\/div>\n<div>\n<label for=\"ac-8\">You say that organisations must be \u201ctransparent.\u201d What does that mean?<\/label><\/p>\n<article class=\"ac-medium\">The GDPR includes detailed rules about what you must tell individuals about your processing of personal data. This includes, among other things, information about why the personal data is being processed, how long the data will be stored (or, if that is not possible, the criteria used to determine that period), with whom the personal data will be shared, and whether the personal data will be transferred outside the European Economic Area. This information must be presented in a way that is clear and easily accessible. You should review your disclosures against the GDPR\u2019s requirements carefully.<\/article>\n<\/div>\n<div>\n<label for=\"ac-9\">What does it mean that organisations must have a \u201clegal basis\u201d for processing personal data?<\/label><\/p>\n<article class=\"ac-medium\">Under the GDPR, you can\u2019t process personal data simply because you want to. Instead, you must be able to point to a \u201clegal basis\u201d for processing. The GDPR provides several grounds for processing, including where the processing is necessary to perform a contract, where an an individual has consented to the processing of their data, or where the processing is in the organisation&#8217;s \u201clegitimate interest\u201d (assuming that interest is not outweighed by the individual\u2019s rights).<\/article>\n<\/div>\n<div>\n<label for=\"ac-10\">What are the key terms to be aware of in the GDPR?<\/label><\/p>\n<article class=\"ac-medium\">Article 4 of the GDPR includes a list of defined terms used in the regulation. \u00a0Several are particularly important:<\/p>\n<ul>\n<li class=\"ac-medium\">\u201cController\u201d means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.<\/li>\n<li class=\"ac-medium\">\u201cProcessor\u201d means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller.<\/li>\n<li class=\"ac-medium\">\u201cPersonal data\u201d means any information relating to an identified or identifiable natural person (\u201cdata subject\u201d); an identifiable natural person can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.<\/li>\n<li class=\"ac-medium\">\u201cProcessing\u201d means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.<\/li>\n<li class=\"ac-medium\">\u201cPseudonymisation\u201d means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.<\/li>\n<\/ul>\n<\/article>\n<\/div>\n<div>\n<label for=\"ac-11\">What about security under the GDPR?<\/label><\/p>\n<article class=\"ac-medium\">The GDPR requires you to take measures to keep personal data secure. \u00a0This includes \u201corganisational measures,\u201d such as limiting the number of people inside your organisation who can access personal data, and \u201ctechnical measures,\u201d such as encryption. The GDPR doesn\u2019t mandate the exact security measures organisations must take, however. Instead, it requires organisations to determine security measures themselves, depending on factors like the nature of the personal data, its sensitivity and the risks involved in the processing. \u00a0<\/article>\n<article class=\"ac-medium\"><\/article>\n<article class=\"ac-medium\">There are many types of security risks to consider, from physical intrusion to rogue employees, to accidental loss and to online hackers. Building risk management plans and taking risk mitigation steps, such as password protection, audit logs and encryption, can help ensure compliance.<\/article>\n<\/div>\n<div>\n<label for=\"ac-12\">Are the six principles described above the only requirements set out by the GDPR?<\/label><\/p>\n<article class=\"ac-medium\">No. There are many more requirements in the GDPR. For example, the GDPR gives individuals a number of rights over their personal data, such as the right to access or correct their personal data or to have it deleted. You will need to have plans in place to respond to individuals who want to exercise these rights.You may also need to comply with other requirements, such as observing special rules about profiling individuals; keeping careful records of processing; following principles of \u201cprivacy by design\u201d and \u201cprivacy by default\u201d; appointing a data protection officer; reporting data breaches; carrying out data protection impact assessments; and limiting transfers of data to certain destinations outside the European Economic Area, among other obligations.<\/article>\n<\/div>\n<div>\n<label for=\"ac-13\">You mention individuals\u2019 rights. Can you say more?<\/label><\/p>\n<article class=\"ac-medium\">Individuals have many rights under the GDPR that organisations must respect. This includes rights to access the personal data you hold about them; to have their personal data corrected or deleted (the \u201cright to be forgotten\u201d); to ask you to stop processing their personal data; to object to direct marketing; and to revoke consent for certain uses of their personal data. Additionally, the right to data portability means you must provide individuals their personal data in a way that makes it easy for them to move their personal data elsewhere.<\/article>\n<\/div>\n<div>\n<label for=\"ac-14\">How does the GDPR require \u201cprivacy by design\u201d and \u201cby default\u201d?<\/label><\/p>\n<article class=\"ac-medium\">Under the GDPR, you are expected to incorporate privacy features and functionality into your products and services from the time they are first designed. The GDPR doesn\u2019t dictate the features. Instead, you should develop features based on factors like the nature of the processing and the privacy risks it poses; the need for security; and the cost of implementation. You must also implement measures to ensure that, by default, no more data is processed than is necessary.<\/article>\n<\/div>\n<div>\n<label for=\"ac-15\">What kind of record-keeping does the GDPR require?<\/label><\/p>\n<article class=\"ac-medium\">Large organisations must maintain detailed internal records of processing activities. This includes records about the purposes of processing, the categories of personal data processed, transfers of personal data outside the European Economic Area, and the security measures employed to protect data. Auditing tools can help you ensure that any processing of personal data \u2013 whether it be collection, use, sharing, or otherwise \u2013 is tracked and recorded.<\/article>\n<\/div>\n<div>\n<label for=\"ac-16\">Do we need to carry out data protection impact assessments and what do they involve?<\/label><\/p>\n<article class=\"ac-medium\">You must carry out data protection impact assessments if your processing activities present high risks to the rights and freedoms of individuals. These assessments generally involve identifying and documenting privacy risks raised by proposed processing, and planning mitigation measures to help control and minimise those risks. In some cases, organisations must also consult data protection authorities before undertaking processing.<\/article>\n<\/div>\n<div>\n<label for=\"ac-17\">What does the GDPR require if a data breach occurs?<\/label><\/p>\n<article class=\"ac-medium\">The GDPR defines a \u201cpersonal data breach\u201d as \u201ca breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.\u201d In the event of a personal data breach, the GDPR requires notice to regulators within 72 hours of detecting the breach. You may also need to notify affected individuals if there is a significant risk of harm due to the breach.<\/article>\n<\/div>\n<div>\n<label for=\"ac-18\">What if my organisation transfers data to countries outside of the EU?<\/label><\/p>\n<article class=\"ac-medium\">The GDPR strictly regulates transfers of personal data of European residents to destinations outside the European Economic Area. You may need to set up a specific legal mechanism, such as a contract, or adhere to a certification mechanism in order to enable these transfers. Microsoft details the mechanisms we use in the Online Services Terms.<\/article>\n<\/div>\n<div>\n<label for=\"ac-19\">If my business uses a vendor to process personal data, what do I need to know?<\/label><\/p>\n<article class=\"ac-medium\">The GDPR requires controllers to only use processors that guarantee they will \u201cimplement appropriate technical and organisational measures\u201d such that the rights of data subjects are protected and the processing requirements of the GDPR are satisfied. In the context of enterprise online services such as Office 365, Microsoft is a processor and our customers are the controller.<\/article>\n<article class=\"ac-medium\"><\/article>\n<article class=\"ac-medium\">Microsoft recently offered its volume licensing customers a contractual commitment, known as the \u201cGDPR Terms\u201d, to meet the GDPR\u2019s contractual requirements with regard to Microsoft\u2019s enterprise online services. Among other things, the GDPR Terms commit that Microsoft will only process data in accordance with a controller\u2019s instructions; will provide controllers with advance notice and an opportunity to object to new sub-processers; will support controllers in managing data subject requests; will abide by the GDPR breach notification requirements; will assist controllers with data protection impact assessments and related consultations; and will ensure the security of processing in accordance with the GDPR.<\/article>\n<\/div>\n<div>\n<label for=\"ac-20\">Can Microsoft Help Us Meet the Requirements of the GDPR?<\/label><\/p>\n<article class=\"ac-medium\">Yes. Microsoft stands ready to help organisations meet the GDPR compliance deadline of 25th May\u00a02018. \u00a0The Microsoft Cloud can help you achieve compliance.<\/article>\n<\/div>\n<\/section>\n<p><a class=\"wp-footer-link\" href=\"https:\/\/enterprise.microsoft.com\/en-gb\/articles\/roles\/get-started-gdpr\/\">Next step: Where to get started with the GDPR<\/a><br \/>\n<a class=\"wp-footer-link\" href=\"https:\/\/www.microsoft.com\/en-gb\/atwork\/uk_cloud_workshops\/#gdpr+\" target=\"_blank\">Find out more at a GDPR cloud workshop<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The General Data Protection Regulation is a new privacy regulation across the European Union; get help understanding how it will affect you. <\/p>\n","protected":false},"author":223,"featured_media":1206,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"_classifai_error":"","footnotes":""},"categories":[1,141,142,143,144,145],"post_tag":[],"content-type":[],"coauthors":[24],"class_list":["post-466","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cross-industry","category-financial-services","category-government","category-health","category-manufacturing","category-retail"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.9 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Helping you and your organisation understand the GDPR - Microsoft Industry Blogs - United Kingdom<\/title>\n<meta name=\"description\" content=\"The General Data Protection Regulation is a new privacy regulation across the European Union; get help understanding how it will affect you.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2017\/06\/07\/understand-gdpr\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Helping you and your organisation understand the GDPR - Microsoft Industry Blogs - United Kingdom\" \/>\n<meta property=\"og:description\" content=\"The General Data Protection Regulation is a new privacy regulation across the European Union; get help understanding how it will affect you.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2017\/06\/07\/understand-gdpr\/\" \/>\n<meta property=\"og:site_name\" content=\"Microsoft Industry Blogs - United Kingdom\" \/>\n<meta property=\"article:published_time\" content=\"2017-06-07T11:27:29+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2018-11-22T15:20:50+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-content\/uploads\/sites\/22\/2017\/05\/GDPR_Landing-Page-Hero_960x300.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"960\" \/>\n\t<meta property=\"og:image:height\" content=\"300\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Microsoft\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Microsoft\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"12 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2017\/06\/07\/understand-gdpr\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2017\/06\/07\/understand-gdpr\/\"},\"author\":[{\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/author\/microsoft\/\",\"@type\":\"Person\",\"@name\":\"Microsoft\"}],\"headline\":\"Helping you and your organisation understand the GDPR\",\"datePublished\":\"2017-06-07T11:27:29+00:00\",\"dateModified\":\"2018-11-22T15:20:50+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2017\/06\/07\/understand-gdpr\/\"},\"wordCount\":2479,\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2017\/06\/07\/understand-gdpr\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-content\/uploads\/sites\/22\/2017\/05\/GDPR_Landing-Page-Hero_960x300.jpg\",\"articleSection\":[\"Cross-industry\",\"Financial services\",\"Government\",\"Health\",\"Manufacturing\",\"Retail\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2017\/06\/07\/understand-gdpr\/\",\"url\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2017\/06\/07\/understand-gdpr\/\",\"name\":\"Helping you and your organisation understand the GDPR - Microsoft Industry Blogs - United Kingdom\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2017\/06\/07\/understand-gdpr\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2017\/06\/07\/understand-gdpr\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-content\/uploads\/sites\/22\/2017\/05\/GDPR_Landing-Page-Hero_960x300.jpg\",\"datePublished\":\"2017-06-07T11:27:29+00:00\",\"dateModified\":\"2018-11-22T15:20:50+00:00\",\"description\":\"The General Data Protection Regulation is a new privacy regulation across the European Union; get help understanding how it will affect you.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2017\/06\/07\/understand-gdpr\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2017\/06\/07\/understand-gdpr\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2017\/06\/07\/understand-gdpr\/#primaryimage\",\"url\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-content\/uploads\/sites\/22\/2017\/05\/GDPR_Landing-Page-Hero_960x300.jpg\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-content\/uploads\/sites\/22\/2017\/05\/GDPR_Landing-Page-Hero_960x300.jpg\",\"width\":960,\"height\":300},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2017\/06\/07\/understand-gdpr\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Helping you and your organisation understand the GDPR\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/#website\",\"url\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/\",\"name\":\"Microsoft Industry Blogs - United Kingdom\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/#organization\",\"name\":\"Microsoft Industry Blogs - United Kingdom\",\"url\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-content\/uploads\/sites\/22\/2019\/08\/Microsoft-Logo.png\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-content\/uploads\/sites\/22\/2019\/08\/Microsoft-Logo.png\",\"width\":259,\"height\":194,\"caption\":\"Microsoft Industry Blogs - United Kingdom\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Helping you and your organisation understand the GDPR - Microsoft Industry Blogs - United Kingdom","description":"The General Data Protection Regulation is a new privacy regulation across the European Union; get help understanding how it will affect you.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2017\/06\/07\/understand-gdpr\/","og_locale":"en_US","og_type":"article","og_title":"Helping you and your organisation understand the GDPR - Microsoft Industry Blogs - United Kingdom","og_description":"The General Data Protection Regulation is a new privacy regulation across the European Union; get help understanding how it will affect you.","og_url":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2017\/06\/07\/understand-gdpr\/","og_site_name":"Microsoft Industry Blogs - United Kingdom","article_published_time":"2017-06-07T11:27:29+00:00","article_modified_time":"2018-11-22T15:20:50+00:00","og_image":[{"width":960,"height":300,"url":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-content\/uploads\/sites\/22\/2017\/05\/GDPR_Landing-Page-Hero_960x300.jpg","type":"image\/jpeg"}],"author":"Microsoft","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Microsoft","Est. reading time":"12 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2017\/06\/07\/understand-gdpr\/#article","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2017\/06\/07\/understand-gdpr\/"},"author":[{"@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/author\/microsoft\/","@type":"Person","@name":"Microsoft"}],"headline":"Helping you and your organisation understand the GDPR","datePublished":"2017-06-07T11:27:29+00:00","dateModified":"2018-11-22T15:20:50+00:00","mainEntityOfPage":{"@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2017\/06\/07\/understand-gdpr\/"},"wordCount":2479,"publisher":{"@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/#organization"},"image":{"@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2017\/06\/07\/understand-gdpr\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-content\/uploads\/sites\/22\/2017\/05\/GDPR_Landing-Page-Hero_960x300.jpg","articleSection":["Cross-industry","Financial services","Government","Health","Manufacturing","Retail"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2017\/06\/07\/understand-gdpr\/","url":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2017\/06\/07\/understand-gdpr\/","name":"Helping you and your organisation understand the GDPR - Microsoft Industry Blogs - United Kingdom","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2017\/06\/07\/understand-gdpr\/#primaryimage"},"image":{"@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2017\/06\/07\/understand-gdpr\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-content\/uploads\/sites\/22\/2017\/05\/GDPR_Landing-Page-Hero_960x300.jpg","datePublished":"2017-06-07T11:27:29+00:00","dateModified":"2018-11-22T15:20:50+00:00","description":"The General Data Protection Regulation is a new privacy regulation across the European Union; get help understanding how it will affect you.","breadcrumb":{"@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2017\/06\/07\/understand-gdpr\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2017\/06\/07\/understand-gdpr\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2017\/06\/07\/understand-gdpr\/#primaryimage","url":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-content\/uploads\/sites\/22\/2017\/05\/GDPR_Landing-Page-Hero_960x300.jpg","contentUrl":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-content\/uploads\/sites\/22\/2017\/05\/GDPR_Landing-Page-Hero_960x300.jpg","width":960,"height":300},{"@type":"BreadcrumbList","@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2017\/06\/07\/understand-gdpr\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/"},{"@type":"ListItem","position":2,"name":"Helping you and your organisation understand the GDPR"}]},{"@type":"WebSite","@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/#website","url":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/","name":"Microsoft Industry Blogs - United Kingdom","description":"","publisher":{"@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/#organization","name":"Microsoft Industry Blogs - United Kingdom","url":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-content\/uploads\/sites\/22\/2019\/08\/Microsoft-Logo.png","contentUrl":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-content\/uploads\/sites\/22\/2019\/08\/Microsoft-Logo.png","width":259,"height":194,"caption":"Microsoft Industry Blogs - United Kingdom"},"image":{"@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-json\/wp\/v2\/posts\/466"}],"collection":[{"href":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-json\/wp\/v2\/users\/223"}],"replies":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-json\/wp\/v2\/comments?post=466"}],"version-history":[{"count":0,"href":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-json\/wp\/v2\/posts\/466\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-json\/wp\/v2\/media\/1206"}],"wp:attachment":[{"href":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-json\/wp\/v2\/media?parent=466"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-json\/wp\/v2\/categories?post=466"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-json\/wp\/v2\/post_tag?post=466"},{"taxonomy":"content-type","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-json\/wp\/v2\/content-type?post=466"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-json\/wp\/v2\/coauthors?post=466"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}