George Scott, director for KPMG’s cyber and privacy practice in Scotland, warns companies in the upstream energy sector of impending changes to data protection laws in the form of General Data Protection Regulations
The EU’s new General Data Protection Regulation (GDPR), which will supersede the 1998 Data Protection Act, heralds a new era for data privacy.
Go deeper with GlobalData
GDPR is a recognition of the importance and sensitivity of data handling for the 21st century, particularly as we leave behind an unparalleled year for cyberbreaches across sectors.
While the last five years have seen significant data loss incidents – with some commentators suggesting a laissez-faire attitude from consumer giants towards security – the oil and gas industry should take heed of these breaches and look at its own data handling practices before the new EU GDPR regulations come into effect in 2018.
For those questioning their eligibility, given the UK’s decision to leave the EU, the UK regulator has confirmed its commitment to the GDPR and its underlying principles. Non-compliance with GDPR could mean that oil and gas firms will immediately restrict themselves from trading with the EU. Therefore, if by 25 May 2018, data-handling policies are not up to industry standards, in addition to jeopardising revenue streams, firms may face fines of up to €20m or 4% of annual turnover – whichever is greater – an unthinkable amount for any business, and the last thing the sector needs.
GDPR will impact any business that stores personal data electronically – regardless of size and function. This includes the majority of operators, contractors and third-party supply-chain partners.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataAssume that if you hold any information that falls within the scope of the Data Protection Act of 1998 – which includes staff records, contractor lists, contact details and the like – then you are required to comply.
Companies must also have the ability to register breaches with the relevant authorities within 72 hours. To do this comprehensively they need to have understood the complexities of the regulations, and have mapped out data collection and processing steps, right through the supply chain.
This will take time, and board directors should recognise this is a problem for today. Failure to prepare and invest now means paying the price tomorrow.
The implementation of the EU GDPR requires comprehensive changes to business practices for companies that may not have ever implemented a comparable level of privacy before.
Simply put, there are exceptional financial, legal and reputational drivers for oil and gas businesses to ensure they are compliant with the new regulations come May 2018.
