10 Steps to GDPR Compliance

Why?

A Privacy Impact Assessment enables you to identify all the processes/activities that involve personal data and demonstrates to the ICO that you have carefully considered personal data within your business.

 How?

Complete a PIA for each information stream in your business, we have a host of template documents to help you and your business comply, contact us for further information.

Why?

This data protection policy statement is your commitment  of intent as an organisation to Data protection. It is a formally recognised document that your customers and website users should be able to access easily.

How?

If you don’t have a DPS you will need one, then you need to consider if it needs to be publicly available or internal only. You should send it to new and prospective clients, share with suppliers and host on your website for ease of access.

Why?

A Data Retention Policy is required to support the creation, retrieval, proper storage and preservation of essential personal data records, and to enable identification and destruction of information where there is no continuing business, legal or historical significance. This policy tells your staff and clients how long after transactions you should be holding personal data. A schedule defines the different types of records typically found in businesses.  It may not capture all the personal data/records that you may have in your company.  Where any are missing, you need to add these to the ‘Other’ tab within the document.   The schedule defines any legal retention requirements/ guidance on best practice from the ICO.

How?

Create the policy, or work with a consultant like Blackmores to create the policy for you and make the Policy and schedule available to staff.

Why?

In the interest of transparency (a GDPR principal requirement), you are required to provide privacy information to data subjects when you are collecting their personal data. Typically, you will find a Privacy policy is put onto the website (as generally this is where you may have data capture forms).

How?

Have a look at what you have got already in your Privacy Policy and if it needs updating within the section related to Legal Basis for processing (as per the PIA/Data Matrix outputs) as not all may apply.

• Display it in an ‘easy to digest’ format on your website. i.e. section headers with an overview paragraph – they option to expand to see full details.
• Add in a link to this page on your email signatures
• Have a think where else in the business where you might be collecting personal data that you should be providing some level of privacy information i.e. Terms of engagement (use the same headings if possible).

Why?

This is the document that you need to describe the process for reporting data breaches or security weaknesses, events, and investigation of security incidents.  All staff must be made aware of document and understand the procedure as they have responsibilities to be able to know how to report breaches/ security incidents as they become aware of them.

How?

Write up your procedure and make it available to staff and ensure they’re aware of their data protection/ information security breach responsibilities as appropriate.

Why?

The checklist is to capture the key elements relating to a data breach to ensure actions are recorded and progressed as appropriate. The root cause can then be understood, and that is any new/changed controls are needed to be made and applied as part of the lessons learnt activities.

How?

Ensure it’s availability to staff and they understand and are aware of their data protection/ information security breach responsibilities as appropriate.

Why?

As stipulated by GDPR any individual that you hold information on has a right to know what data you hold on them eg name, address, etc – this info can be requested by an individual using a  ‘Data Subject Access Request’. There are rules relating to how long you have to respond (within 30 days) to these requests and this log enables you to keep track of any requests in progress, or any historical requests made. 

How?

Write up your procedure outlining the steps to be followed by staff upon receiving this request, what information they need to record and how to go about it. This will ensure that your company receives and processes Data Subject Access Requests in accordance with the General Data Protection Regulations.

Why?

Since the UK split from the EU in 2018, they made some minor tweaks to their GDPR rules and regulations. If you conduct business within the EU there maybe some changes you need to be aware of that may not apply if your transactions remain within the UK.

How?

Ensure you’re up-to-date on the differences in procedures and outcomes. Contact our GDPR consultants for a full run down and to discuss your organisation.

Why?

Most data breaches/ Information Security breaches/incidents can be traced back to an individual’s actions or decisions. Providing awareness training to staff is a form of control that you may need to evidence to the ICO/Client in the event of a data breach.

How?

GDPR training is something we can help you with when you choose to work with Blackmores as your GDPR consultants. We ensure all staff receive this training and retain evidence that this training has been delivered i.e. staff training records.

Why?

This questionnaire is to check that the suppliers that your business shares personal data with are GDPR compliant. It is a requirement for your company to check the security and data protection compliance of any processors/ sub-processors used by the business

How?

1. Identify those suppliers/ partners to whom you may supply personal data (Use the Data Matrix/ PIA results as a reference point)
2. Send the questionnaire to the companies likely to respond.
3. Conduct the required due diligence for larger organisations and retain evidence of findings
4. Take action depending on the outcome of the questionnaires/ proactive due diligence.