![\"\"](\"https:\/\/www.glassmountains.co.uk\/wp-content\/uploads\/2018\/03\/Screen-Shot-2018-03-23-at-09.02.13-e1521795827352-1024x552.png\")
<\/p>\n<\/p>\n
After last’s week intro GDPR post<\/a>, I’d like to present a more in-depth point of view from a GDPR expert, Tony Dowling<\/a>.<\/em><\/p>\n Tony is a 25 year plus media guy, the last 6 year or so specialising in digital transformation, specifically helping traditional businesses embraces digital methodologies and technologies<\/em><\/p>\n Ok, over to Tony….\u00a0<\/em><\/p>\n It feels like the world has gone GDPR crazy! Everywhere you look newly minted GDPR exerts are popping up with lots of conflicting advice and legal mumbo jumbo that is either scaring people or making people feel like putting their heads in the sand until it all goes away.<\/p>\n As if you didn\u2019t know the GDPR is the General Data Protection Regulations that will be legally enforced from 25th May 2018. You can find details here on the Information Commissioners Website<\/a>.<\/p>\n At the GDPR Alliance we are keen to offer the ubiquitous awareness training and the information sessions, but also keen to actually support business toward compliance. We operate in easy to understand language and suggest simple, specific steps to take, backed up by insights drawn from some of the best people in the sector, who all belong to the Alliance.<\/p>\n For the purposes of this article, I think we can break down GDPR into three areas. These are very much top line, and this article certainly doesn\u2019t constitute proper consultancy or legal advice for your business, but it should give you a head start as to what to look for as you begin your journey.<\/p>\n First of all, who does the GDPR apply to? Basically anyone \u2018processing\u2019 personal data on European data subjects (people).<\/p>\n Processing means storing, or communicating with, or segmenting, or any number of other activities you can conduct with personal data.<\/p>\n \u2018Personal data\u2019 means any information that could be used to identify a natural person. That is a person currently alive and living in Europe. And no, Brexit doesn\u2019t mean GDPR won\u2019t apply.<\/p>\n So, if you have a marketing data base, a HR database, a list of job applicants, a list of suppliers, a client list etc. then chances are you are processing personal data, and that data will need to comply with GDPR.<\/p>\n The three areas to think about are:<\/p>\n Cyber Security<\/strong>: You\u2019ve heard the term no doubt, but what does it mean? Well, simply put, keeping your IT infrastructure safe. Safe from breach (someone or something breaking in) and safe from all sorts of nasty viruses. Chances are, if you have completed the Cyber Essentials or Essentials plus programmes, you are well on your way.<\/p>\n If you are buying \u2018off the shelf\u2019 services like CRM systems or websites, or invoicing platforms etc. it\u2019s worth talking to your suppliers about how they are, or will be compliant, as they themselves are a risk in terms of the security picture for your business.<\/p>\n And even if you are being looked after by a reputable IT firm (and if you are not, it\u2019s worth thinking about) it\u2019s worth checking with them as to what steps they are taking. Get them to report to you on a regular basis on the state of your IT, and its compliance. But don\u2019t be lulled into a false sense of security. There is more to GDPR than that.<\/p>\n Processes<\/strong>: The GDPR talks about having data security built into your processes. This means having your privacy statements up to date for each data set you use and making sure the citizens\u2019 rights like the so called \u2018right to be forgotten\u2019 are honoured in all aspects of the business. How you gather data, how its stored, who gets to use it and the legal basis for which you are using the data are examples of the processes you need to think about.<\/p>\n Something like the BS 10012:2017 (Data privacy) standard is a great place to start to ensure you are running your business and the data you are processing in a compliant manner, but again, this is also something the GDPR Alliance can help you with.<\/p>\n The data itself<\/strong>: You must be aware of what data you have. And that includes understanding where you might be keeping data that you aren\u2019t immediately aware of, like in a CRM system or a mailing list in Mail Chimp, or a survey tool, or even somewhere like your websites contact forms.<\/p>\n I mentioned your \u2018legal basis\u2019 earlier and I think this is the cause of much of the confusion, with many different versions of what is allowed and what constitutes \u2018legal basis\u2019.<\/p>\n Again, in simple terms, the GDPR says you are OK to process data if:<\/p>\n 1. You have the consent of the data subject. This consent must live up to standards of specificity and transparency, and it much be explicit for the use to which you will put it. It\u2019s no longer good enough to have a pre-checked box on your data gathering forms. It\u2019s also likely to mean that data you hold that might have had consent some time ago, maybe doesn\u2019t have that consent anymore! You can get more clarification of the legal basis on the ICO website or by talking to your GDPR Alliance consultant or other professional such as your web developer or IT supplier.<\/p>\n If you haven\u2019t got the contracted right, or the legal requirement, most business will be looking at \u2018consent\u2019 and \u2018legitimate interest\u2019 as the basis for their data processing. But the questions don\u2019t end there.<\/p>\n Consent is intended to be weighted toward the benefit of the data subject and should be as easy to withdraw as it is to give.<\/p>\n And legitimate interested must be demonstrated through the application of a three stage \u2018test\u2019 called a Legitimate Interest Assessment the ICO and DMA<\/a> advise you to apply. Namely, identification of the legitimate interest (the reason) a necessity test (can same be accomplished any other way?) and a balancing test (does the processing impose upon the data subjects rights?)<\/p>\n It\u2019s a complicated picture, but like all processes it can be broken down into simple steps. You aren\u2019t going to get compliant by May if you still haven\u2019t taken any action, but even now, you can go a long way to offsetting your risk by acting now.<\/p>\n And if you really can\u2019t do it yourself, look for a reputable, experience GDPR consult in your IT suppliers team, your web developer, or indeed, from the members of the GDPR Alliance<\/a>.<\/p>\n Good luck!<\/p>\n Tony Dowling
\n2. You can have a legal basis if you have a contract with the data subject which requires the processing of their data. Such as a guarantee for instance.
\n3. There may be a legal requirement for you to hold data on someone in order to comply with the law. Maybe safeguarding information or information on finance agreements.
\n4. Your processing of the data might be in the vital interest of the data subject, for instance in order to save a life you might need to pass on privileged information to an ambulance crew.
\n5. If you have a public task to comply with in the interest of the public based in law that can be the basis of your processing.
\n6. You have a legitimate interest in processing the data, as long as that interest doesn\u2019t outweigh the interest of the data subject.<\/p>\n
\nChris Roberts<\/p>\n","protected":false},"excerpt":{"rendered":"