Stephen Zanofsky

a16z Podcast | What to Know about GDPR

Lisa Hawke, Steven Sinofsky, Sonal, Lisa Hock, Stephen Zanofsky

The European Union's GDPR establishes a global privacy standard with long-arm jurisdiction that obligates entities processing data of 28 member states to adhere to strict definitions of personal data and data subject rights. Organizations must distinguish between data controllers and processors while implementing "privacy by design" protocols, facing penalties up to 4% of global turnover if they fail to notify breaches within 72 hours or comply with erasure and access requests. Although startups may leverage organizational nimbleness to adapt faster than legacy corporations, compliance requires a risk-based approach involving detailed data inventory mapping and designated risk sentinels to navigate the regulation's complex triangular data risks.