Step 1 – Conduct a Privacy Impact Assessment (PIA)
Enables you to identify all the processes/activities that involve personal data and demonstrates to the ICO that you have carefully considered personal data within your business.
Complete a PIA for each information stream in your business, we have a host of template documents to help you and your business comply, contact us for further information.
Step 2 – Data Protection Policy Statement
This policy is your commitment/statement of intent as an organization to Data protection
If you don’t have a DPS you will need one, then you need to consider if it needs to be publicly available or internal only. You should send it to new and prospective clients and share with suppliers.
Step 3 – Data Retention Policy & Data Retention Schedule
Data Retention Policy – This is required to support the creation, retrieval, proper storage and preservation of essential personal data records, and to enable identification and destruction of information where there is no continuing business, legal or historical significance.
Schedule – This schedule defines the different types of records typically found in businesses. It may not capture all the personal data/records that you may have in your company. Where any are missing, you need to add these to the ‘Other’ tab within the document. The schedule defines any legal retention requirements/ guidance on best practice from the ICO.
Action: Make the Policy and schedule available to staff.
- Display it in an ‘easy to digest’ format on your website. i.e. section headers with an overview paragraph – they option to expand to see full details.
- Add in a link to this page on your email signatures
- Have a think where else in the business where you might be collecting personal data that you should be providing some level of privacy information i.e. Terms of engagement (use the same headings if possible).
Step 5 – Security Incident Procedure
This is the document that you need to describe the process for reporting data breaches or security weaknesses, events, and investigation of security incidents. All staff must be made aware of document and understand the procedure as they have responsibilities to be able to know how to report breaches/ security incidents as they become aware of them.
- Write up your procedure and make it available to staff and ensure they’re aware of their data protection/ information security breach responsibilities as appropriate.
Step 6 – Information Security Breach Checklist
The checklist is to capture the key elements relating to a data breach to ensure actions are recorded and progressed as appropriate. The root cause can then be understood, and that is any new/changed controls are needed to be made and applied as part of the lessons learnt activities.
- Ensure it’s availability to staff and they understand and are aware of their data protection/ information security breach responsibilities as appropriate.
Step 7 – Subject Access Request (SAR) Procedure
As stipulated by GDPR any individual that you hold information on has a right to know what data you hold on them eg name, address, etc – this info can be requested by an individual using a ‘Data Subject Access Request’.
Write up your procedure outlining the steps to be followed by staff upon receiving this request, what information they need to record and how to go about it. This will ensure that your company receives and processes Data Subject Access Requests in accordance with the General Data Protection Regulations.
Step 8 – Subject Access Request (SAR) Log
There are rules relating to how long you have to respond (within 30 days) to these requests and this log enables you to keep track of any requests in progress, or any historical requests made. This log is linked to/ referenced within the Subject Access Request procedure.
Step 9 – GDPR Staff Training
Most data breaches/ Information Security breaches/incidents can be traced back to an individual’s actions or decisions. Providing awareness training to staff is a form of control that you may need to evidence to the ICO/Client in the event of a data breach.
- Ensure all staff receive this training.
- Retain evidence that this training has been delivered i.e. staff training records
Step 10 – Supplier Data Compliance Questionnaire
This questionnaire is to check that the suppliers that your business shares personal data with are GDPR compliant. It is a requirement for your company to check the security and data protection compliance of any processors/ sub-processors used by the business
- Identify those suppliers/ partners to whom you may supply personal data (Use the Data Matrix/ PIA results as a reference point)
- Send the questionnaire to the companies likely to respond.
- Conduct the required due diligence for larger organisations and retain evidence of findings
- Take action depending on the outcome of the questionnaires/ proactive due diligence.
- Use your common sense when it comes to protecting your client dataJ
- Review your client terms of engagement – are you being transparent about the handling and protection of your client data?
- Complete the Privacy Impact Assessment (PIA)
- Identify your risks and implement the organisational controls (Policies, procedures and training)
- Identify the risks and implement the technological controls i.e. data back-up, anti-virus software, restricted access, password management.
What is data subject consent?
This is clearly defined by GDPR, what the data subjects wishes are in processing their data.
What is a freedom of information request?
Under the GDPR, individuals will have the right to obtain:
- confirmation that their data is being processed;
- access to their personal data; and
- other supplementary information – this largely corresponds to the information that should be provided in a privacy notice
You must provide a copy of the information free of charge. However, you can charge a ‘reasonable fee’ when a request is manifestly unfounded or excessive, particularly if it is repetitive.
You may also charge a reasonable fee to comply with requests for further copies of the same information. This does not mean that you can charge for all subsequent access requests.
In order to provide the information you must verify the identity of the person making the request, using “reasonable means”. If the request is made electronically, you should provide the information in a commonly used electronic format.
Our 7 Steps to Success
The Blackmores ISO Roadmap is a proven path to go from idea to launching your ISO Management System.
Whether you choose to work with one of our isologist consultants or work your own way through the process on our isology Hub, we’re certain you’ll achieve certification in no time!
What our clients have to say
The support and advise I get from our assigned auditors is immense. Forward planning for the following year is great and they are flexible and always willing to help.
“Blackmores have assisted us almost since the start of our adoption of the ISO 9001 quality standard. Their input has improved our processes since the start, and enabled our goal of continuous improvement to be achieved. The people are also extremely easy to get on with, and they really understand our business, giving us a great deal of confidence in their advice.”
“Blackmores are the perfect bridge between working on your ISO as an individual or company, to being audited each year. We find that any queries we have are covered and we feel sure that we have everything as needs be before going into an external audit.”
“We have been extremely impressed with the service and support provided by Blackmores. There knowledge and assistance through out our ISO journey has been amazing!”
“Blackmores have really kept us on our toes with the broad scope and level of detail they apply to our internal audit schedule. They always stay abreast of ISO standard changes and help us to adapt our processes and documents to embrace these changes accordingly. Having Blackmores shadow our external audits provides invaluable confidence and peace of mind – would highly recommend their services!”
“Our ISO 27001 certification project has gone so well, that there was no doubt in who we were going to ask to help us with our aspirations of becoming ISO 14001 certified. It’s been an absolute pleasure working with Blackmores, and we are really looking forward to working with them for the foreseeable future.”
Trusted by leading organisations across all sectors, we support companies of all sizes in any location.
Listen to our Podcast
Welcome to the ISO Show podcast, dispelling myths and sharing tips for success to improve your business with ISO Standards. Join us to hear interviews with successful business leaders as they share their ISO journey with you.
Get top tips via audio master classes “ISO Steps to Success” on the most popular ISO Standards.