Burdens araising from the General Data Protection Regulation

Enormous burdens due to GDPR

The bureaucratic burden in Europe makes day-to-day operations difficult for companies. This is also confirmed by the study on the General Data Protection Regulation (GDPR). It comprises the now fourth part of a research project commissioned by the Foundation for Family Businesses that deals with this topic.

The study analyses in detail the regulatory constraints companies in Germany, Austria, France and Italy face resulting from compliance with Articles 30 and 33.

Article 30 of the GDPR requires that companies create and maintain records of personal data processing activities. Article 33 of the GDPR obliges controllers to record personal data breaches and to report specific breaches to the competent data protection authority.

The first part of the study looks at the legal implementation, which is by no means uniform. It was prepared by the Paris law firm Alerion and the Freiburg-based Centres for European Policy Network.

The second part, which was prepared by Prognos AG, Berlin, and CSIL, Milan, deals with the stresses and strains of concrete implementation. They are described as significant. Micro-enterprises are particularly affected, as are large companies due to their often complex business models.

Overall, considerable internal and external measures are necessary to fulfil all requirements. However, the authors of the study make it clear that measures certainly exist to reduce the administrative burden – and make concrete suggestions.