A new data protection law, the General Data Protection Regulation (GDPR), comes into force in May 2018, overhauling current data protection legislation. Here, we explain why all businesses need to take notice.
The General Data Protection Regulation (GDPR) increases consumer rights over the way their data is collected, maintained and shared. It must be met by anyone handling personal data of EU citizens, and no business is exempt.
Personal data refers to ‘anything, from a name, a home address, a photo, an email address, bank details, medical information or a computer’s IP address’.
If you handle EU citizen data, you will need to show compliance to the new regulation, ideally by having someone in your business responsible for data protection and ensuring you gain a customer’s consent before using their data (using the ‘opt in’ rather than current ‘opt out’ mechanism).
Given the obligation to notify within such a reduced time frame, and failure to comply with GDPR resulting in a hefty fine – up to 4% of global annual turnover up to a maximum of €20m – businesses need to think carefully about how they hold and manage personal data.
You will also need to have an action plan in case of a data breach. This will involve notifying customers and reporting the incident to the Information Commissioner’s Office (ICO) within 72 hours. This is a short amount of time, given that you will need to both determine the extent of the problem and communicate with affected customers within this time frame.
Your preparation for the impact of GDPR should be underway; whatever the size of your business. Here are 12 steps to help you get ready for one of the biggest changes in data regulation for many years.
- Awareness – Ensure key people and decision makers are aware of the impact this is likely to have.
- Document the information you should hold, where it came from and how you used it. Create an information audit if you need to.
- Communicate your privacy notices and update if necessary in readiness for the implementation of GDPR.
- Check your procedures to cover the rights of individual’s data, including how you delete records and how you transmit data.
- Plan who has access to data records and who has the ability to amend and update records when required. This ensures a transparent audit trail of who is using the data and for what purpose.
- Confirm the legal basis you have for using the data you hold and document it.
- Review the way you obtain data with particular regards to obtaining and recording consent to use it from the individual.
- Plan how you verify ages of individuals when data gathering to ensure if dealing with minors parental/ guardian consent is obtained and recorded.
- Ensure you have procedures in place to detect, investigate, and report a personal data breach.
- Use the guidance of Privacy Impact Assessments to understand how to implement them within your business.
- Designate a Data Protection Officer, if necessary. This must be a responsible person as the role should sit within your company governance arrangements.
- If you deal internationally, you will need to determine which data protection supervisory authority you come under.
Obviously, full compliance with the new regulation will help mitigate your risks and appear favourably to underwriters. Our advice to businesses is act now – ensure you are ready to comply with GDPR when it comes into force in 2018.
- De Novo Risk Solutions is a specialist Risk and Insurance Broker based in Malvern, Worcestershire. We provide professional and expert advice to a number of industry sectors. Call us on 01684 218618 or e-mail us for your free quote.
*Source: http://smallbusiness.co.uk/cyber-security-hygiene-2538146/- Why SMEs need to be aware of GDPR. https://doorda.com/lugus/smes-exposure-gdpr/- The Risks to SME’s and Those Who Insure Them. https://www.hiscox.co.uk/business-blog/every-small-business-must-know-gdpr-newdata-privacy-law/ What every small business must know about GDPR – the new data privacy law. Preparing for the GDPR – Information Commissioner’ Office – www.ICO.ORG.uk