What Boards Should Know About the GDPR FAQ

In brief: The European Union’s General Data Protection Regulation (GDPR) requires—with some exceptions—affirmative opt-in and usage notices for data collection in the European Union (EU) by any organization with 250 or more employees. It applies to European organizations collecting data within the EU and non-European companies with data subjects based anywhere in the region. Any person located within the EU is considered to be a “data subject” under the regulation. The regulation mandates in detail the proper procedures related to required data collection and usage, including cybersecurity measures, making compliance a challenge, especially for smaller firms.