Getting started with CSRD

What you need to know to prepare your organisation for the EU’s Corporate Sustainability Reporting Directive 

The Corporate Sustainability Reporting Directive (CSRD) is an ESG (environmental, social and governance) standard enacted by the EU. It is designed to make corporate sustainability reporting more common, consistent and standardised like financial accounting and reporting. 

The new directive’s impact is far-ranging and essentially modernises and strengthens the social and environmental information that companies have to report. 

Why do I need to think about it now?

Because CSRD entered into force on July 25, 2024. EU member states have until July 26, 2026 to transpose the Directive into national law. On July 26, 2027, the rules will start to apply to companies, with a gradual phase-in between 3 and 5 years after entry into force. 

CSRD will require all large and listed companies to publish regular reports on the social and environmental risks they face, and on how their activities impact people and the environment. It will dramatically increase the number of businesses that are subject to mandatory ESG disclosures from 15,000 to over 50,000. It will also impact non-EU companies, called third-country companies, that have substantial activity in the EU. 

Businesses need to prepare now as successful reporting will require a holistic approach that involves the entire organisation. 

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”

Picture of James

James

VinciWorks CEO, VInciWorks

Spending time looking for your parcel around the neighbourhood is a thing of the past. That’s a promise.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.