12 steps to gdpr compliance unleashed

GDPR
12 steps to compliance
web: www.weareunleashed.com Tel: 0333 240 0565 email:unleashyourit@weareunleashed.com

GDPR (General Data Protection Regulations) comes into effect from
25th May 2018. This is new legislation replacing the outdated Data
Protection Act 1998. This means, it is imperative that planning starts
as soon as possible. Businesses in the UK need to be properly
prepared for these changes. You will need to study these new
regulations with a view to operation needs and business risk.
To enable you to become GDPR compliant, Unleashed would like
you to consider our 12 steps to compliance.
web: www.weareunleashed.com Tel: 0333 240 0565 email:unleashyourit@weareunleashed.com

1.EducationandAwareness
Planning is going to be key to getting GDPR compliant. To enable you
to get compliant, you will need to ensure key personnel are familiar
with what GDPR means. And, how it effects your business.
web: www.weareunleashed.com Tel: 0333 240 0565 email: unleashyourit@weareunleashed.com

2.Accountability
You will need to demonstrate that you are compliant with data
protection principles.
This means, where you hold and store all personal information. This
information includes name, address, phone numbers and
bank/credit card details.
For GDPR purposes you will need to ensure you know where all
personal data is held and who has access to it.

3.LegalBasis
Under GDPR, individuals now have a lot more rights and your
business will need to accept these. And ensure you are lawfully
processing information.
As part of your planning process, you will need to include a legal
basis before any personal data is processed. This is also called
‘conditions for processing’.
This simplified means, you have to have the consent of the data
subject to store their data.

4.Consent
Every business must have a data controller (DC) from May 2018.
One of the roles of the DC is to demonstrate you have consent from
the individual to store their data. If you don’t, you need to delete it
or you could be in breach and fined.
Your business must, maintain and retain an audit trail and the
history of the data over its lifetime.

5.PrivacybyDesign
This is a new approach and it means that any new project that
includes data must promote privacy and data protection compliance
from conception.
New Projects that could be effected are:
• New IT systems that allow for storing or accessing data
• Developing strategies that have privacy implications
• Data file sharing or using data for new purposes.

6.Individual’sRights
If an individual requests you to remove their personal details, this
must be done immediately.
This will have huge implications for IT departments. They will need
to document where all personal data is held. They will need to know
who has access to it and restrict that access to staff who need to
know. It also means, you will need to know where all personal data
is stored.
A data retention policy must now be clearly defined and followed by
all users.

7.PrivacyNotices
All businesses will need to revise their Privacy Notices to meet the
new demands of GDPR. You will now have to include notices that
are clear and unambiguous about how you process all personal data
and define retention periods.
This means, if you don’t need to store personal data, you
shouldn’t.

8.SubjectAccessRequest
This is commonly know as subject access. It comes into effect when an individual
asks a company what information is held about them.
Sometimes a admin fee is attached to this information as it is normally a written
request.
An individual is now entitled to:
• Be told whether any personal information has been processed
• Given a description of personal data held and the reason it is being processed
and whether it has been passed to any other organisation
• Given a copy of data held on them and where it came from.

9.Children
GDPR has tightened all aspects of storing data on children. This means, children
now have special protection known as ‘consent to process children’s personal
information’
Consent now has to be verified and must state, where this data has come from.
All privacy notices, must be written in a way a child can understand. i.e. in plain
understandable language, not legal speak!

10.DataBreachNotification
This is the area that could potentially cost you money if you are not prepared.
You should prepare a data breach notice in advance and know who to send it to
in the event of a data breach. You now have 72 hours to report a breach (from
the time you became aware of it). In this notice, you have to state, what
information has been subjected to the breach, how it happened and steps you
have taken to mitigate further breaches.
The timescale of 72 hours (3 days) also includes bank holidays and weekends. So
if a breach occurs on a Friday, you can’t wait till Monday to prepare the
notification.

11.DataController
GDPR requires someone to take responsibility and ownership for ensuring your
business has effective data protection compliance. The Data Controller is
obligated to carry the following:
• Data Processing Agreements
• Controller instructions
• Accountability
• Data Security
• Data Protection Officer
• Sanctions
• Cross Border Transfers

12.InternationalOperations
This only comes into effect if you trade overseas. Basically, this means the ‘Lead
Authority’ or your head office will be liable for any breach no matter where that
breach occurred within the company.
If you head office is Norway, and the breach was in the UK. Then Norway will
liable not the UK.
You will now need to be aware of where your data is processed and stored. So a
good idea is to educate your users on all the relevant rules and regulations.

AboutUnleashed
Unleashed is a boutique IT consultancy. We offer consultancy services on a
number of IT solutions. Our main objective is to work with our clients in tackling
the problems that exist between IT and the rest of the business.
We have been advising our customers and clients on Cyber and Information
Security for many years. We have experience in ISO 27001 and Cyber Essentials.
We are happy to talk to you about any concerns you have about GDPR or help
you to put together is Risk Assessment Plan prior to implementation of GDPR.

12 steps to gdpr compliance unleashed

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to 12 steps to gdpr compliance unleashed

Similar to 12 steps to gdpr compliance unleashed (20)

Recently uploaded

Recently uploaded (20)

12 steps to gdpr compliance unleashed