Is the General Data Protection Regulation (GDPR) on your radar?

15 August 2017


During July 2017 the CIPP ran a poll asking about employer readiness for May 2018 when the General Data Protection Regulation (GDPR) is implemented in the UK. We received 343 responses in total.

It is encouraging that almost a third (31%) have begun data preparation and just over a third (34%) have a plan in place to start preparation.

However 29% stated that reading the poll was the first time they had heard of GDPR and the remaining 6%, although having heard of GDPR, did not think it is applicable to their organisation. If you fall into these two categories it would be beneficial to read on.

GDPR preparation (excerpt from CIPP half day training course)

The objectives of the preparation for GDPR should be to ensure that:

  • The organisation can demonstrate its services and operations comply with GDPR

  • The risk of reputational damage and financial loss from regulatory actions and legal claims is reduced or mitigated

As part of the preparation for GDPR you should assess current compliance with the Data Protection Act (DPA) 1998. As a first step seek answers to, at least, the following questions:

  1. Which business processes handle and store sensitive data?

  2. Where is all of the sensitive data stored?

  3. Do suppliers and third parties only process personal data as authorised?

  4. Are risks to personal data being managed effectively (and in line with GDPR)?

  5. Are reports of compliance compiled and retained?

  6. Can the data held be retrieved in the appropriate format (e.g. csv) if requested?


For questions 1 and 2 it is important to review the organisation’s data flows. An audit of the data flows will allow the organisation to:

  • Map the locations where personal data is used and/or held
  • Gain visibility over all personal data flows
  • Develop effective strategies to protect personal data
  • Improve data lifecycle management
  • Implement process efficiencies
  • Reduce privacy related risks.

Question 3 is particularly relevant for organisations which outsource any HR and payroll processes and should involve, at least, a review of existing contracts with relevant suppliers to ensure that the GDPR requirements on a processor are reflected in the contract and if not, to introduce an addendum to the contract.

Questions 4 and 5 allude to the organisation’s responsibilities under GDPR to maintain effective governance measures and to be able to demonstrate and justify such measures. 

Question 6 – the regulation requires that data is provided in a commonly used electronic format. 

Follow this link for full details of the CIPP half day training course (in-house training options are available). This course will help you understand and prepare for the changes under GDPR, including how they affect payroll and HR functions. Be prepared so that you can help your organisation become fully compliant by May 2018.

 

12 steps to take now

The ICO has a useful document ‘Preparing for the General Data Protection Regulation (GDPR)’ 12 steps to take now.

Awareness

You should make sure that decision makers and key people in your organisation are aware that the law is changing to the GDPR. They need to appreciate the impact this is likely to have.

Information you hold

You should document what personal data you hold, where it came from and who you share it with. You may need to organise an information audit.

Individuals’ rights

You should check your procedures to ensure they cover all the rights individuals have, including how you would delete personal data or provide data electronically and in a commonly used format.

Communicating privacy information

You should review your current privacy notices and put a plan in place for making any necessary changes in time for GDPR implementation.

Lawful basis for processing personal data

You should identify the lawful basis for your processing activity in the GDPR, document it and update your privacy notice to explain it.

Subject access requests

You should update your procedures and plan how you will handle requests within the new timescales and provide any additional information.

Consent

You should review how you seek, record and manage consent and whether you need to make any changes. Refresh existing consents now if they don’t meet the GDPR standard.

Data breaches

You should make sure you have the right procedures in place to detect, report and investigate a personal data breach.

Children

You should start thinking now about whether you need to put systems in place to verify individuals’ ages and to obtain parental or guardian consent for any data processing activity.

Data Protection by Design and Data Protection Impact Assessments

You should familiarise yourself now with the ICO’s code of practice on Privacy Impact Assessments as well as the latest guidance from the Article 29 Working Party, and work out how and when to implement them in your organisation.

Data Protection Officers

You should designate someone to take responsibility for data protection compliance and assess where this role will sit within your organisation’s structure and governance arrangements. You should consider whether you are required to formally designate a Data Protection Officer.

International

If your organisation operates in more than one EU member state (ie you carry out cross-border processing), you should determine your lead data protection supervisory authority. Article 29 Working Party guidelines will help you do this.

This was just an overview of the 12 steps, for further details go to the ICO’s website.

 

 


More news