Dealing with gamers Data address privacy concerns in be advisable even if not required. relation to apps. Breach reporting: A breach Certain information about data must be reported to the relevant protection and cookies must be regulator without undue delay presented at the outset. This can be and, where feasible, within 72 a challenge in an app environment hours of becoming aware of it and the use of banners, just in time unless the breach is unlikely to notices and pop ups together with result in a risk to the rights and links to full details will be required. freedoms of individuals. Breaches may also have to be reported to Additional areas to individuals concerned, without think about undue delay, where there’s a high Territorial scope: the UK GDPR risk to their rights and freedoms. applies to non-UK organisations Data Protection Impact offering goods or services to data Assessments: organisations must subjects in the UK or monitoring carry these assessments out if their behaviour (if such monitoring their proposed activities are likely takes place in the UK); the GDPR to result in a high risk to the rights has similar reach in terms of the EU. and freedoms of individuals. Penalties: maximum penalties Consultations with the applicable of 4% of annual global turnover regulator before beginning the or up to GBP17.5m/EUR20m processing may also be needed (whichever is higher). depending on the level of risk. Appointment of a Data Protection Privacy by design and default: Officer: this is required where controllers are specifically an organisation’s core business prevented from setting defaults involves processing personal data to disclose data to all and should involving regular and systematic take data privacy into account at monitoring of data subjects the design stage. The UK GDPR/ or large amounts of sensitive GDPR also apply to processors personal data but may (who process personal data on 103