GDPR

The General Data Protection Regulation (GDPR) came into force on 25 May 2018. The GDPR automatically became law in all Member States of the European Union and the European Economic Area (EU/EEA).

The aims of the GDPR are to:

1. Harmonise data privacy laws across the EU;
2. Modernise data privacy laws in the light of technological change;
3. Enhancement the rights of individuals;
4. Increase the accountability requirements and obligations for data controllers and data processors; and
5. Ensure better records and evidence of compliance with data protection legislation and more transparency as to how data is used, by whom it is used and for what.

The GDPR applies to businesses (whether in the EU or not) that are processing the personal data of individuals in the EU including the personal data of GlobalLogic customers, their end clients and employees.

What is GlobalLogic doing about the GDPR?

GlobalLogic, a Hitachi Group Company, processes personal data both as a controller and as a processor and we take our obligations under the GDPR very seriously. In order to prepare for GDPR we undertook a program of activities including in particular:

1. An audit of our global data processing activities;
2. An assessment of data security across our group;
3. Updates to our training, policies and procedures;
4. Ensuring that appropriate terms are in place with our vendors acting as data processors and sub-processors.
5. Updates to our use of cookies and similar technology in our website, marketing emails and our mechanisms for allowing users to express their marketing preferences.

Under our GDPR program we continuously monitor changes of applicable laws, new data protection authorities’ guidelines and decisions, and best market practice. We review our practices, policies and procedures and update them accordingly, at least on an annual basis.

What are GlobalLogic’s commitments to customers and data subjects?

GlobalLogic is committed to complying with the requirements of the GDPR in practice; this means that we are committed to do the following when we are processing data for our customers:

1. We only process personal data, that you control and for which you are responsible, at your request, in accordance with the agreement we have with you, a written instruction or as required by law;
2. We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks that are presented by the processing, which may include End Point, Gateway and Server Level Security at our premises, strong password polices, daily anti-virus updates, use on encryption, SSL VPN for external access, secure access over wired and wireless networks to our systems, central patch management, access control, polices and training among others;
3. We take all reasonable steps to ensure that only authorised personnel subject to confidential obligations have access to the personal data;
4. We will only engage sub-processors to assist in the performance of the services we deliver to you, with your consent. We will hold sub-processors to terms no less onerous than these commitments made to you;
5. We will not deliberately do anything to place you in breach of the GDPR and will tell you if we become aware that your instructions run contrary to what the GDPR permits;
6. We will assist you to fulfil any requests received by data subjects (individuals) to exercise their rights or any regulator requests;
7. We will inform you straight away after becoming aware of any breach or suspected breach that might compromise your data or put it at risk;
8. Where we need to transfer personal data out of the EU/EEA, we will do so subject to appropriate legal safeguards.

The above list is not exhaustive and GlobalLogic is committed to meeting all of its obligations as processor of personal data controlled by our customers or their end clients under the GDPR.

If you have any questions about our approach to data privacy please contact privacy@globallogic.com and we will be happy to discuss with you further.