Accenture's Global Approach To General Data Protection Regulation Implementation

- 

General

On 25 May 2018, the General Data Protection Regulation (GDPR)1 came into force. This is a Regulation designed to unify data privacy laws across the European Union (EU), and protect and strengthen the data privacy rights of individuals in the EU. GDPR strives to reshape the way organizations approach data privacy, with a focus on, among others, accountability, widening the territorial scope of the EU data protection obligations, increasing individual rights, and imposing material fines for non-compliance.

The Regulation protects the data of all individuals located in the EU, regardless of their nationality. If a tech company (even when outside the EU) hosts, handles or exchanges the data of any EU resident, it is required to be GDPR compliant. GDPR requires strengthening of data privacy controls, enhancing of technology for management of personal data, and the supplying of detailed documentation. In the past, only data controllers (those who determine the how and the why of data processing) assumed responsibility for data protection. Now, for the first time, data processors (those processing data on behalf of the data controller – mainly suppliers), too, have direct compliance risk and obligation.

Accenture’s Approach

The GDPR is a step change in regulatory data privacy expectations and places significant new requirements on both Accenture’s clients and Accenture’s operations, not just in the EU, but globally. Because the GDPR applies to processing of personal data of individuals in the EU, regardless of where it is processed or stored, Accenture is addressing the new requirements across all geographies as a consistent, global standard to address client needs.

The following highlights some of Accenture’s efforts in responding to GDPR requirements:

Embedding GDPR requirements into Accenture’s Client Data Protection (CDP) program