This document provides a practical guide for businesses to prepare for the General Data Protection Regulation (GDPR) which takes effect on May 25, 2018. It outlines six key steps: 1) audit personal data held, 2) review how data is processed, 3) review consent processes, 4) review contracts, 5) ensure a data breach process, and 6) other compliance steps. Key actions include documenting personal data, reviewing lawful bases for processing, updating privacy policies and employee training. The guide emphasizes establishing lawful and transparent processing of personal data under the GDPR.

1. The Business
Journey
March 20 2018

2. Social Media
Follow: @TheBusJourney
Hashtag: #SMEJourney

3. Business Journey Partner
Laura Forrest
@MHSolicitors

4. The Business Journey
GDPR – Are you ready?
20th March 2018
www.macdonaldhenderson.co.uk © 2017

5. Practical Guide
1 - Audit and document the personal data
your business holds

6. Personal Data
What is personal data?
 “personal data” means any information relating to an identified
or identifiable natural person (‘data subject’)…who can be
identified, directly or indirectly, in particular by reference to an
identifier such as a name, an identification number…or to one or
more factors specific to the physical, physiological, genetic,
mental, economic, cultural or social identity of that natural
person;
(Article 4, GDPR)

7. Practical Guide
2 – Look at your current practice of
processing data

8. Personal Data
 “processing” means any operation or set of
operations which is performed on personal
data…such as collection, recording, organisation,
structuring, storage, adaptation or alteration,
retrieval, consultation, use, disclosure by
transmission, dissemination or otherwise making
available, alignment or combination, restriction,
erasure or destruction;
(Article 4, GDPR)

9. Lawful Basis for Processing
 Contract
 Legal Obligation
 Vital Interests
 Public Task
 Legitimate Interests
 Consent

10. Practical Guide
3 – Review consents and obtaining consents
processes

11. Consent
To rely on consent as a lawful basis for processing the consent
must be:
 Freely given;
 Specific;
 Informed;
 Unambiguous;
 Explicit;

12. Lawful Basis for Processing
The principle behind identifying a lawful basis is
that:
“personal data shall be…processed lawfully, fairly
and in a transparent manner in relation to the data
subject”.

13. Practical Guide
4 – Review of your commercial contracts

14. Practical Guide
5 – Ensure you have a process in place for
any data breaches

15. Practical Guide
6 – Other steps to achieve compliance

16. Key Points of Action
 Audit and document the personal data your business holds;
 Look at your current practice of processing data;
 Review consents and obtaining consent processes;

17. Key Points of Action
 Review commercial contracts to consider the new data
processing obligations;
 Ensure you have a process in place for data breaches;

18. Key Points of Action
 Review all privacy notices and policies currently used and
implement updates where necessary;
 Review all employment policies in respect of data protection
and implement updates where necessary;
 Introduce training for employees where applicable;

19. Contact Details
For further information on the policies, procedures and contractual amendments
required to assist with compliance with the GDPR
Laura Forrest
0141 248 4957
laura@macdonaldhenderson.co.uk

20. THANK YOU

21. Questions for Laura

22. Dates for the diary
12 June
11 September
27 November