{"id":4453,"date":"2018-05-23T16:30:20","date_gmt":"2018-05-23T15:30:20","guid":{"rendered":"https:\/\/www.sage.com\/en-gb\/blog\/?p=4453"},"modified":"2026-01-29T10:37:50","modified_gmt":"2026-01-29T10:37:50","slug":"finance-professionals-gdpr","status":"publish","type":"post","link":"https:\/\/www.sage.com\/en-gb\/blog\/finance-professionals-gdpr\/","title":{"rendered":"GDPR for finance professionals: 3 things you need to know"},"content":{"rendered":"
\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\tStrategy, Legal & Operations<\/a>\t\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t
\n\t\t\t\t\t

\n\t\t\t\t\t\tGDPR for finance professionals: 3 things you need to know\t\t\t\t\t<\/h1>\n\t\t\t\t<\/div>\n\n\t\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\t\t\t\t\t\t<\/p>\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t<\/div>\n\t\t

\n\t\t
\n\t\t\tPublished
\n\t
\n\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\n\t\t
\n\t\t\t\n\t\t\t\t\"\"\t\t\t\tKeir Thomas-Bryant<\/span>\n\t\t\t<\/a>\n\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t<\/div>\n<\/div>\n\n\n\n

The deadline for compliance with the European Union\u2019s (EU\u2019s) General Data Protection Regulation (the GDPR<\/a>) is Friday 25th May 2018. It will affect all businesses and as finance professionals, you need to know what it means for you and your company.<\/p>\n\n\n\n

The focus is on personal data<\/a>, or data about individuals, and is a significant shake-up that affects any sole trader, partnership, corporation, public authority, agency or other body that processes the personal data of individuals who are based in the EU. This includes suppliers and other third parties a company might use to process personal data on their behalf.  <\/span><\/p>\n\n\n\n

Businesses in all industries work with personal data such as contact details, bank account information and National Insurance numbers. These belong to customers, suppliers, sub-contractors and employees, and must all be secured under the new regulation. <\/span><\/p>\n\n\n\n

Let\u2019s look at three examples of how the GDPR might affect finance professionals during their day-to-day work.<\/p>\n\n\n\n

1. Don\u2019t get caught out by international transfers<\/strong><\/h2>\n\n\n\n

Regulatory compliance might be viewed by many as an administrative burden. However, ignoring the GDPR or getting it wrong could have costly repercussions<\/a>.<\/p>\n\n\n\n

A serious GDPR infringement is the failure to observe the requirements for international transfers \u2013 if the data is being transferred to a country outside the EU that isn’t deemed to have adequate security levels. It’s these things that can incur the really hefty fines under the GDPR.  <\/span><\/p>\n\n\n\n

The GDPR continues the general prohibition on sending personal data outside the European Economic Area to a country that does not provide adequate protection.<\/p>\n\n\n\n

At the time of writing, the countries deemed by the European Commission to provide \u201cadequate\u201d protection are: US companies that self-certify to the European Union-US Privacy Shield arrangement (note: this does not mean the US as a country is considered to provide adequate protection), Andorra, Argentina, Canada (limited to PIPEDA), Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland and Uruguay.  <\/span><\/p>\n\n\n\n

Where no adequacy decision exists, transfers can only be made in limited circumstances, including on the basis of consent, the use of standard contractual clauses published by the European Commission or, in the case of inter-company transfers, the use of Binding Corporate Rules. <\/span><\/p>\n\n\n\n

2. Do you need <\/strong>a data protection officer<\/strong>?<\/strong> <\/span><\/h2>\n\n\n\n

The supervisory authority can impose a fine of up to 4% of annual global turnover, or \u20ac20m, whichever is greater. However there’s a two-tier system in play.<\/p>\n\n\n\n

The lower tier is half of that, so up to 2% of annual global turnover or \u20ac10m, whichever is greater. The lower tier is for breaches that aren\u2019t considered to be as significant \u2013 so, for example, things like not appointing a data protection officer (DPO) when it is mandatory.  <\/span><\/p>\n\n\n\n

Among other things under the GDPR, companies and any third parties that process personal data on their behalf will need to appoint a DPO if the core activities of the business or third parties involve monitoring of individuals on a large scale, or if the core activities consist of processing on a large scale of special categories of personal data, including data relating to criminal convictions and offences.  <\/span><\/p>\n\n\n\n

The DPO needs to have expert knowledge of data protection law, although they don\u2019t necessarily need to be an employee and could instead be employed on a service contact to fulfil the role. Details of the DPO will need to be communicated to the supervisory authority, such as the ICO <\/a>in the UK. <\/span><\/p>\n\n\n\n

It will be the job of the DPO to inform the company and its staff about their obligations under the GDPR. They will also have to monitor compliance with the GDPR (and any other data protection laws or requirements).<\/p>\n\n\n\n

This could include managing data protection impact assessments, conducting internal audits and organising staff training. The DPO will also be the first point of contact for data-protect-related enquiries from supervisory authorities such as the ICO, and the point of contact for any individuals whose data is processed by the company \u2013 including customers, clients and employees. <\/span><\/p>\n\n\n\n

3<\/strong>. Finance professionals should u<\/strong>se the opportunity to improve <\/strong>data quality<\/strong> <\/span><\/h2>\n\n\n\n

But it\u2019s not all bad news. Finance departments should also think about the way the GDPR can result in better data quality, through initiatives like a centralised data depository where data is deduplicated and cleaned up.  <\/span><\/p>\n\n\n\n

Alongside compliance, businesses should think about adding analytics to the high-quality data that may result. Reliable information can result in a more accurate and enriched customer database, which chief financial officers can leverage to make better decisions.<\/p>\n\n\n\n

Remember that most people won\u2019t immediately demand that their data be deleted. If you\u2019re providing a good service, many will be happy to allow your business to use their data if it benefits them.  <\/span><\/p>\n\n\n\n

For example, it allows you to better understand them and tailor your service for what they need. Customers will be happy if you present your product at the right time to them through your understanding and wise management of their personal data. <\/span><\/p>\n\n\n\n

\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t

GDPR<\/h2>\n\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t

<\/p>\n

Need help with meeting your GDPR obligations and making sure your businesses processes are working in the correct way? Here’s what you need to know.<\/p>\n

<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tFind out more<\/a>\n\t\t\t\t\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t\"Working\t\t\t<\/div>\n<\/div>\n\n\n

\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t

Subscribe to the Sage Advice newsletter<\/h2>\n\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t

Join more than 500,000 UK readers and get the best business admin strategies and tactics, as well as actionable advice to help your company thrive, in your inbox every month.<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tSubscribe now<\/a>\n\t\t\t\t\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t\"\"\t\t\t<\/div>\n<\/div>\n\n

\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t

Browse more topics from this article<\/h3>\n\t\t\t<\/div>\n\t\t\t
\n\t\t\t\t