View all newsletters
Receive our newsletter – data, insights and analysis delivered to you
  1. Analysis
  2. Comment
September 25, 2017

Industry insight – GDPR: Take heed today and avoid the major penalties tomorrow

By George Scott

George Scott, director for KPMG’s cyber and privacy practice in Scotland, warns companies in the upstream energy sector of impending changes to data protection laws in the form of General Data Protection Regulations

The EU’s new General Data Protection Regulation (GDPR), which will supersede the 1998 Data Protection Act, heralds a new era for data privacy.

GDPR is a recognition of the importance and sensitivity of data handling for the 21st century, particularly as we leave behind an unparalleled year for cyberbreaches across sectors.

While the last five years have seen significant data loss incidents – with some commentators suggesting a laissez-faire attitude from consumer giants towards security – the oil and gas industry should take heed of these breaches and look at its own data handling practices before the new EU GDPR regulations come into effect in 2018.

For those questioning their eligibility, given the UK’s decision to leave the EU, the UK regulator has confirmed its commitment to the GDPR and its underlying principles. Non-compliance with GDPR could mean that oil and gas firms will immediately restrict themselves from trading with the EU. Therefore, if by 25 May 2018, data-handling policies are not up to industry standards, in addition to jeopardising revenue streams, firms may face fines of up to €20m or 4% of annual turnover – whichever is greater – an unthinkable amount for any business, and the last thing the sector needs.

GDPR will impact any business that stores personal data electronically – regardless of size and function. This includes the majority of operators, contractors and third-party supply-chain partners.

Assume that if you hold any information that falls within the scope of the Data Protection Act of 1998 – which includes staff records, contractor lists, contact details and the like – then you are required to comply.

Companies must also have the ability to register breaches with the relevant authorities within 72 hours. To do this comprehensively they need to have understood the complexities of the regulations, and have mapped out data collection and processing steps, right through the supply chain.

This will take time, and board directors should recognise this is a problem for today. Failure to prepare and invest now means paying the price tomorrow.

The implementation of the EU GDPR requires comprehensive changes to business practices for companies that may not have ever implemented a comparable level of privacy before.

Simply put, there are exceptional financial, legal and reputational drivers for oil and gas businesses to ensure they are compliant with the new regulations come May 2018.

NEWSLETTER Sign up Tick the boxes of the newsletters you would like to receive. A weekly roundup of the latest news and analysis, sent every Thursday. The leasing industry's most comprehensive news and information delivered every month.
I consent to GlobalData UK Limited collecting my details provided via this form in accordance with the Privacy Policy


Thank you for subscribing to Leasing Life