Liz Appleyard from the Commercial Services Team at leading regional law firm Tollers highlights why businesses should get ready for the new data protection regime.
THE new pan-European law on data protection – the General Data Protection Regulation (GDPR) comes into force on 25 May 2018. All businesses will be affected by the new law and need to be ready for it as the maximum level of fine for failing to comply is rocketing from the current £500,000 to the highest of four per cent of global turnover or 20 million euros.
Business people who want to avoid a fine need to be planning for GDPR now. Key steps to take are:
* Review the data that you currently hold; if you no longer need it then delete it.
* Consider what data you collect from individuals, how you use this, where you store it and who you share it with.
* Update your privacy policy
* Review what consents you hold from individuals – pre-ticked boxes and siles will no longer be good enough. Consent must be specific, informed and unambiguous.
* Appoint a data protection officer (DPO) – some organisations are required to have a DPO but every organisation should have one person with responsibility for data protection and who can be the primary contact with the Information Commissioner’s Office
* Make sure your internal processes are updated to deal with the right to be forgotten, subject access requests, and the deletion of data
* Put in place a plan for dealing with data breaches. In future all breaches must be notified to the ICO within 72 hours.
* Train your key personnel so that they know what to do if an individual makes contact and makes a specific request in relation to data that you hold about them
The change in the law is coming and the potential penalties will be far more severe than at present if you are in breach. If you would like more information on GDPR then request a copy of our Guide to the General Data Protection Regulation by phoning 01604 258558 or ask to speak to Liz Appleyard in the Commercial Services Team.
