What is European Union General Data Protection Regulation?

The European Union (EU) General Data Protection Regulation (GDPR) came into  effect on the 25^th of May 2018 and unified  the EU member states approach to protecting all EU citizens from privacy and data breaches. Although the key data privacy principles remain largely unchanged from the previous EU Data Protection Directive of 1995, the recently enacted EU GDPR has  extraterritorial scope applicability. The EU GDPR also  expands EU data protection obligations to cover all processing activities related to EU-based data subjects.

RapidRatings approach to UK data post Brexit

When RapidRatings engages with UK suppliers or third parties we seek to obtain a data processing agreement and we use the EU Standard Model Clauses for this. We will continue to take this approach even if Brexit does take place until there is a change in the legal requirements from a privacy perspective.  Within RapidRatings we are closely monitoring Brexit issues continuously and have a plan of action which we are following from a privacy and compliance perspective.

RapidRatings approach to California Consumer Privacy Act (CCPA)

The CCPA defines a business as a for-profit entity that collects consumer personal data and who must be a business in the state of California that meets at least one of the following thresholds:

• Businesses that earn $25,000,000 or more a year in revenue
• Businesses that annually buy, receive, sell or share personal information of 50,000 or more consumers, households or devices for commercial purposes
• Business that derive 50% or more of its annual revenue from selling consumer personal information

RapidRatings does not fall with the scope of CCPA based on the above requirements for example RapidRatings is not set up in California nor are we in the business of buying, selling, or sharing personal data. As such the CCPA is not applicable to RapidRatings,

It is worth highlighting here that RapidRatings' compliance efforts with data protection are at a higher standard given that we comply with the EU’s GDPR which is widely viewed as more stringent data protection law than CCPA. From an information security perspective RapidRatings is ISO27001:2013 certified.

RapidRatings commitment to GDPR compliance

As a SaaS provider, RapidRatings is fully committed to compliance with the GDPR . RapidRatings operates a risk-based approach to GDPR and data protection by evaluating risks to the confidentiality, integrity and availability of our client’s data. To ensure compliance with GDPR requirements, RapidRatings has taken the following approaches:

1. Conducting internal audit to review current practices as it relates to GDPR
2. Engaging with independent Third Parties from an audit perspective as regards our GDPR and Privacy policies and procedures
3. Appointing and assigning a Data Protection Officer to ensure GDPR related compliance, working alongside our Head of Information Security, Chief Technology Officer, and Chief Product Officer
4. Updating internal policies and procedures of RapidRatings to ensure compliance with GDPR
5. Updating Data Security policies and procedures in alignment with RapidRatings' ISO27001:2013 certification
6. Introducing a separate personal data preach policy
7. Reviewing and updating how RapidRatings gets consent from employees and third parties
8. Evaluating technical and/or procedural solutions to satisfy the “Right to be Forgotten” and “Right to Data Portability”
9. Conducting Privacy Impact Assessments
10. Educating and training staff to adequately protect personal data
11. Ensuring Privacy by Design & Privacy by Default

Please visit our Privacy Policy for more information. If you have any questions, please do not hesitate to contact RapidRatings’ Data Protection Officer at legal@rapidratings.com.