The Effect of GDPR on Customer Relations

The EU GDPR becomes effective on May 25, 2018 and is positioned as a disruptive shift in how organizations collect, process, and justify the use of personally identifiable information (PII). It strengthens enforcement, increases penalties, and—because it is an EU regulation rather than a directive—largely supersedes national laws while also applying extraterritorially to organizations doing business with EU residents, even when services are free. Core changes include consent “per purpose” (opt-in by default, freely given, informed, unambiguous, revocable at any time), 72-hour breach notification to authorities, expanded individual rights (access, correction, restriction of processing, and the “right to be forgotten”), data portability, restrictions on automated profiling, and formal governance requirements such as Data Protection Officers and, in some cases, Data Protection Impact Assessments.

These requirements reshape customer interaction: businesses must be explicit about PII usage, sharing, and rights, and must re-earn trust by collecting only necessary data and demonstrating consumer value. While some processing may rely on contracts or “legitimate interest,” the text stresses that legitimate interest is constrained and that individuals must be clearly informed of objection rights—especially for direct marketing and related profiling—creating likely friction for AdTech and similar models.

To meet these obligations at scale, the document argues for centralized Consumer Identity & Access Management (CIAM): unified identity, consent, privacy, and consistent multi-channel user journeys, replacing fragmented, app-by-app implementations. ForgeRock is presented as providing such a platform, including a Profile & Privacy Management Dashboard offering consistent privacy controls (PII access/editing, consent and preferences, app/device management, UMA-based sharing, activity history, and data export/deletion). The central conclusion is to achieve compliance and agility by relying on platforms rather than bespoke coding.

• The EU GDPR becomes effective on May 25, 2018.
• The GDPR applies to organizations doing business with EU residents even if the organization is not based in the EU.
• Pre-checked options for giving consent are not compliant with GDPR.
• Organizations must notify the data protection authority within 72 hours in the case of an assumed or factual breach of PII.
• Data subjects can request access to all PII stored about them and can demand correction of incorrect PII.
• The regulation introduces a right to data portability that enables individuals to transfer their data to another data processor.
• GDPR penalties can be up to 4% of annual group revenue or €20 million, whichever is higher.
• The GDPR mandates a Data Protection Officer role, distinct from a Chief Privacy Officer, with primary responsibility to the supervisory authority.
• GDPR restricts automated profiling and grants data subjects rights to information about how profiling-based decisions are made.
• ForgeRock’s Identity Platform includes a Profile & Privacy Management Dashboard with controls such as PII export and data deletion.

• “As an EU regulation, the GDPR supersedes national law, leaving little room for exemptions at the national level”
• “The GDPR will change the customer interaction, be it through gathering consent, by explicitly providing information about the usage of data, or the individual’s data rights.”
• “Businesses must revisit the user journeys of their customers and consumers to keep them and gain their acceptance for using the PII that is needed by the business.”
• “Managing the consumer’s identity, PII, and access must become a centralized platform service, not a function of every single app and portal anymore.”
• “ForgeRock’s Identity Platform provides a Profile & Privacy Management Dashboard to support the emerging requirements in the age of the EU GDPR”
• “Rely on platforms, not on coding”
• “Consent becomes a major topic with the GDPR.”
• “Legitimate interest is not a free blanket for everything a data processor wants to do with PII.”
• “The user journeys will become more complex by consent management, access to options for revoking consent or objecting to some use of PII, and the need for providing certain information to the individual data subjects.”
• “The days of constructing each and every customer-facing app, application and portal independently, with separate management of identities, privacy, consent, and access, are past.”