The creators of isology®

Can I implement BS 10012 instead of GDPR

Yes. BS 10012 incorporates all the requirements of GDPR, but the key benefit is that it drives ongoing review and improvement of controls implemented to manage these requirements – now and thereafter.

Neither GDPR or BS 10012 alignment happens without input or effort.  Both require action and top level commitment from a business.  There is no ‘off the shelf’ magic answer as every business is different, with its own processes, people, clients and suppliers – all of which generate personal data that needs to be effectively managed within a business.

How much work is involved in implementing BS10012

Neither GDPR or BS 10012 alignment happens without input or effort.  Both require action and top level commitment from a business.  There is no ‘off the shelf’ magic answer as every business is different, with its own processes, people, clients and suppliers – all of which generate personal data that needs to be effectively managed within a business.

Gone are the days when a simple communicated Data Protection policy and registration with the Information Commissioner would suffice for Data Protection compliance.   One of the biggest changes is the ‘accountability’ principle underpinning the six other principles.   You now need to be able to prove you have applied all the principles within your business.

Over and above just the basic principles, you should be striving to:

• Demonstrate that you understand what personal data you control or process,
• Identify the legal basis for processing
• Demonstrate the steps you have taken to understand and control/mitigate risk
• Communicate requirements to interested parties
• ‘Bake in’ Data Protection within your organisation (including required processes and review of planned/unplanned changes)
• Review performance and strive for continual improvement.

When you consider the potential consequences of getting any of this wrong – 4% of global annual revenue or €20M whichever is greater – why wouldn’t you take the best practice approach and implement BS 10012?

There are numerous legislative Acts and Regulations that mandate statutory retention periods for documents such as financial records or HR or Health and Safety records.  In addition to these, business should be stipulating their own retention periods for the data and records they keep (to include those that contain personal data).

There is no single answer to this question, but it is an area that needs to be addressed by businesses as part of adhering to the principle “Stored in a form that permits identification no longer than necessary”

Once defined, the retention policies need to be adhered to!