HYDERABAD: For the IT companies based out of Hyderabad which have business clients or service users in European Union (EU), not compliance with the General Data Protection Regulation (GDPR) meant to protect digital rights of the citizens of EU would attract hefty fines. With GDPR, a privacy law that companies worldwide handling EU citizens’ data must adhere to, coming into effect on Friday, Hyderabad’s IT sector is updating their internal data management processes to comply with the new EU law. Non-compliance with GDPR could prove costly for Hyderabad’s IT sector, especially firms that provide IT Enabled Services and Business Process Outsourcing services, with fines amounting to 20 million euros or four per cent fine from worldwide annual turnover.
The law applies to a company or entity which processes personal data as part of the activities of one of its branches established in the EU, regardless of where the data is processed. “A lot of companies are gearing up as this is mandatory. We are also coming out with processes on how to deal with customer data. Under the new rules, after we access customer data and are done with our work, we have to purge the data.
It should not reside in any of our systems. The data can’t be taken from EU servers to foreign servers either,” said Ranga Pothula, Vice-President & Centre Head (Hyderabad), Infor Global Solutions. Earlier, most companies did not have any formal method. Now, a tree of processes for documentation and education of employees as to how to treat customer data has to be developed.
“To be GDPR compliant, enterprises should be primarily ready in two spheres. First, they should be ready with checks and balances while gathering, processing and protecting personal data of employees, clients and users within locations of EU. Second, enterprises will find it difficult to implement GDPR in supply chain management as the system involves a large number of third-party vendors,” said Rama Kuppa, CEO, ONGO Framework, Hyderabad.