GDPR Guidance – Prepare Yourself for the New Regulations

ContractStore

What is “GDPR”?

General Data Protection Regulation, or GDPR, is the new law protecting personal data, which will apply in the UK with effect from 25 May 2018.  It will replace the current UK Data Protection Act 1998.

Personal data is any data from which an individual can be identified.  For example, this includes employee records and home contact details, online identifiers, CCTV images and call recordings, passport copies, right to work visas etc.

GDPR will impact your whole organisation, ranging from the personal data you collate for new leads (whether on email, in offices or on site) to the contact details you record for customer sales.

What will we need to do differently under the GDPR?

The GDPR introduces greater legal protection over personal data and also introduces certain new requirements, such as

  • the obligation for companies to retain formal records of how they store and process personal data
  • mandatory obligations to report certain breaches of the GDPR to the regulator
  • mandatory obligations to report certain breaches to individuals who may be the subject of a data breach

Additionally, the upper limit for fines for data breaches under the GDPR has increased to up to of 4% of turnover.   The work to implement any required new procedures and policies will need to complete between now and May 2018, to ensure you are GDPR compliant.

Every business should consider:

  1. what personal data they need  to retain and why
  2. how they can work to process such data digitally wherever possible, without the use of hard copies
  3. defining how and when such data may be retained with established retention plans
  4. always deleting or safely destroying any other personal data

What do I need to do now?

Do:

  • Make an audit of any personal data you may collect or deal with in your day to day roles. Note down what you use that data for and start to build a list of different types of personal data that you need, and the reasons for retaining it
  • Decide how you will store any personal data electronically within appropriate company systems, and whether you actually need to process/store personal data in hard copy e.g. in filing cabinets on site.   Whenever feasible personal data should be processed and retained electronically, prior to eventual deletion at the required time; hard copies should be avoided or minimised, then destroyed (shredded) or processed as confidential waste
  • Get ready for preparation of the detailed GDPR policies that you will need over the next few months – these will set out what changes you must make as regards your use and storage of personal data

Don’t:

  • Destroy any personal data in a non-secure manner. For example, no personal data should be discarded into open waste bins.

How we can help you:

ContractStore has launched our Privacy Notice template to meet GDPR requirements.  This replaces our previous Privacy Policy. You can find it here. And we will shortly be launching a GDPR toolkit, to include:

Get More Guidance: Sign up for our free email course

We will take you through the steps to prepare your organisation for GDPR in our 5-part email course. Click here to find out more and sign up.