25 May 2018. That was the date when the new GDPR regulations were introduced. In order to be as prepared as possible, Merak asked for an external audit by Infosentry, specialising in information security and privacy. The conclusion? Merak was able to set up a mature privacy management system with minimal effort, fully in line with the existing information security management system.

GDPR in five points

GDPR is the successor to the guidelines that were approved in 1995, on which all European member states have based their national privacy legislation.

• The GDPR guidelines state that data controllers and data processors must take technical and organisational measures to protect data from data breaches and hackers.
• Companies must seek consent from data subjects in order to collect and use data.
• The data that companies collect must have a purpose, and that purpose must also be clearly communicated. In other words, the declarations must be adapted in clear, comprehensible language.
• Data breaches must be reported to the privacy committee within 72 hours.
• Everyone has the right to ask companies what personal information they have and to delete that information.

Infosentry is part of Cronos Group, Belgium's largest IT consultancy company, with 25 consultants. It audits companies, makes assessments, organises implementation projects and helps companies obtain ISO certificates. “Merak asked us to carry out an independent external assessment,” says Cedric Brosens, Governance, Risk & Compliance Consultant at Infosentry. “They wanted to know where they stood, what GDPR meant to them and what were the pain points they had to overcome by 25 May.”