1.6 What's new in the GDPR?

Although the basic principles of the previous privacy legislation remains the same, the GDPR brings with it a number of important changes: 

• The former "obligation to report" to the Data Protection Authority was replaced by a "self-accountability" whereby researchers themselves have to fill in a register provided by the institution when they work with personal data
• Appoint a  data protection officer or data protection officer of the institution
• performing an  additional risk analysis ( data protection impact assessment)  for high-risk processing (eg processing of sensitive data, profiling, systematic monitoring, combining data sets, use of new technologies, etc.)
• Meeting higher data security requirements by using encryption and  pseudonymization
• comply with the new, stricter standards for  informed consent,  if the processing of personal data is based on this legal basis (see 2.2)
• Publicizing the legal basis for the processing of personal data to data subjects in a clear and transparent manner 
• The obligatory reporting of serious data breaches of personal data to the Data Protection Authority (GBA) within 72 hours.
• comply with the new rules for the transfer of personal data outside the European Economic Area (EEA)
• The Data Protection Authority will have the ability to check, to perform and write out fines
• Extending the rights of data subjects such as "the right to forget or erasure of data" and the right of data portability