The creators of isology®

isology® is a world-leading proven step by step roadmap to achieve ISO certification.

Implemented for over 600 organisations with a 100% success rate, we take you from the planning and creation of your bespoke ISO System though to certification with our 7 step process.

keyboard with GDPR as the enter key
Step 1 – Conduct a Privacy Impact Assessment (PIA)


Enables you to identify all the processes/activities that involve personal data and demonstrates to the ICO that you have carefully considered personal data within your business.


Complete a PIA for each information stream in your business, we have a host of template documents to help you and your business comply, contact us for further information.

Step 2 – Data Protection Policy Statement


This policy is your commitment/statement of intent as an organization to Data protection


If you don’t have a DPS you will need one, then you need to consider if it needs to be publicly available or internal only. You should send it to new and prospective clients and share with suppliers.

Step 3Data Retention Policy & Data Retention Schedule


Data Retention Policy – This is required to support the creation, retrieval, proper storage and preservation of essential personal data records, and to enable identification and destruction of information where there is no continuing business, legal or historical significance.

Schedule – This schedule defines the different types of records typically found in businesses.  It may not capture all the personal data/records that you may have in your company.  Where any are missing, you need to add these to the ‘Other’ tab within the document.   The schedule defines any legal retention requirements/ guidance on best practice from the ICO.

Action: Make the Policy and schedule available to staff.

Step 4 – Privacy Policy Template


In the interest of transparency (a GDPR principle requirement), you are required to provide privacy information to data subjects when you are collecting their personal data.  Typically you will find a Privacy policy is put onto the website (as generally this is where you may have data capture forms).


Have a look at what you have got already in your Privacy Policy and if it needs updating within the section related to Legal Basis for processing (as per the PIA/Data Matrix outputs) as not all may apply.

  • Display it in an ‘easy to digest’ format on your website. i.e. section headers with an overview paragraph – they option to expand to see full details.
  • Add in a link to this page on your email signatures
  • Have a think where else in the business where you might be collecting personal data that you should be providing some level of privacy information i.e. Terms of engagement (use the same headings if possible).

Step 5 – Security Incident Procedure


This is the document that you need to describe the process for reporting data breaches or security weaknesses, events, and investigation of security incidents.  All staff must be made aware of document and understand the procedure as they have responsibilities to be able to know how to report breaches/ security incidents as they become aware of them.


  • Write up your procedure and make it available to staff and ensure they’re aware of their data protection/ information security breach responsibilities as appropriate.

Step 6 – Information Security Breach Checklist


The checklist is to capture the key elements relating to a data breach to ensure actions are recorded and progressed as appropriate. The root cause can then be understood, and that is any new/changed controls are needed to be made and applied as part of the lessons learnt activities.


  • Ensure it’s availability to staff and they understand and are aware of their data protection/ information security breach responsibilities as appropriate.

Step 7 – Subject Access Request (SAR) Procedure


As stipulated by GDPR any individual that you hold information on has a right to know what data you hold on them eg name, address, etc – this info can be requested by an individual using a  ‘Data Subject Access Request’.


Write up your procedure outlining the steps to be followed by staff upon receiving this request, what information they need to record and how to go about it. This will ensure that your company receives and processes Data Subject Access Requests in accordance with the General Data Protection Regulations.

Step 8 – Subject Access Request (SAR) Log


There are rules relating to how long you have to respond (within 30 days) to these requests and this log enables you to keep track of any requests in progress, or any historical requests made.  This log is linked to/ referenced within the Subject Access Request procedure.

Step 9 – GDPR Staff Training


Most data breaches/ Information Security breaches/incidents can be traced back to an individual’s actions or decisions.  Providing awareness training to staff is a form of control that you may need to evidence to the ICO/Client in the event of a data breach.


  • Ensure all staff receive this training.
  • Retain evidence that this training has been delivered i.e. staff training records

Step 10 – Supplier Data Compliance Questionnaire


This questionnaire is to check that the suppliers that your business shares personal data with are GDPR compliant. It is a requirement for your company to check the security and data protection compliance of any processors/ sub-processors used by the business


  • Identify those suppliers/ partners to whom you may supply personal data (Use the Data Matrix/ PIA results as a reference point)
  • Send the questionnaire to the companies likely to respond.
  • Conduct the required due diligence for larger organisations and retain evidence of findings
  • Take action depending on the outcome of the questionnaires/ proactive due diligence.

Next steps………

  1. Use your common sense when it comes to protecting your client dataJ
  2. Review your client terms of engagement – are you being transparent about the handling and protection of your client data?
  3. Complete the Privacy Impact Assessment (PIA)
  4. Identify your risks and implement the organisational controls (Policies, procedures and training)
  5. Identify the risks and implement the technological controls i.e. data back-up, anti-virus software, restricted access, password management.

icon of a padlock

What’s the difference between BS 10012 and GDPR?

The General Data Protection Regulations (GDPR) are the requirements for data protection across the EU, laid down in law; therefore, every organisation that controls or processes personal data is legally obliged to comply with the requirements and must be able to demonstrate the application of data protection principles.

BS 10012:2017 is a Standard – a framework –  to assist organisations in meeting the legal obligations laid out in the GDPR Articles and Recitals.  Not only does BS10012:2017 address all the operational requirements of GDPR within Clauses 5 – 8, it also addresses how businesses can ensure they align their data protection responsibilities within the overall strategy of the business through context, leadership and continual improvement.  But more importantly, it ensures ongoing compliance to GDPR.

Can I implement BS 10012 instead of GDPR

Yes. BS 10012 incorporates all the requirements of GDPR, but the key benefit is that it drives ongoing review and improvement of controls implemented to manage these requirements – now and thereafter.

Neither GDPR nor BS10012 alignment happens without input or effort.  Both require action and top level commitment from a business.  There is no ‘off the shelf’ magic answer as every business is different, with its own processes, people, clients and suppliers – all of which generate personal data that needs to be effectively managed within a business.

May 25th 2018 – GDPR becomes law

This is the date the ICO has set for all organisations to align with GDPR.
Are there any legal implications for my business?

GDPR becomes law on May 25th 2018.  Therefore compliance to the requirements becomes a legal implication for your business on this date.

Steve wood, the Information Commissioner’s Office Head of International Strategy & Intelligence has quashed any suggestions of a soft start to GDPR. He stated “You will not hear talk of grace periods from people at the ICO. That’s not part of our regulatory strategy.”  He explained the ICO intend to focus on risk and will be happy to work with organisations if there are any areas that seem unclear but there will be no grace period.
What happens if my company does not comply?

Under the GDPR there are tiers of fines that can be imposed depending on the severity of breach.  The worst case scenario for fines are 4% of global turnover or £20M – whichever is greatest.

Not only are fines imposed, but the ICO  ‘name and shame’ businesses that are in breach.  This is not a new development – this is also the case under the DPA. More information can be found HERE.

Node IT Solutions and Blackmores, specialists in Quality, Risk & Environmental Management, are repeating their sell-out GDPR & Cyber Essentials Business Briefing. Join us on the 22nd May for this FREE Business Briefing, the link to register can be found below.

The General Data Protection Regulations (GDPR) will come in to force on 25th May 2018.

If your business controls or processes any personal information – e.g. employee and/or customer data – you will need to comply. Failure to do so could cost you dearly, resulting in heavy fines and serious damage to the reputation of your business.

Central to GDPR compliance is making sure that the personal data your business deals with is controlled and processed securely. Businesses of all sizes are increasingly under threat from cyber attacks. If you have not put the appropriate technical measures in place to protect personal data, your business will be liable should you suffer a data breach.

Cyber Essentials is the UK Government Cyber Security standard for all businesses and organisations. Meeting the standard demonstrates that your business is taking all reasonable steps to protect the data you hold, and that you take cyber security seriously.

Feedback from the first event was overwhelmingly positive:

“The Business Briefing was informative, clear and easy to follow and has given me some invaluable insight into GDPR and Cyber Security. After attending the meeting I now feel really positive and am looking forward to putting everything I learned into place for my business.”


9:00-9:30 Arrival: tea, coffee & refreshments

9:20-9:30 Introduction

9:30-10:10 Mel Blackmore, Blackmores
GDPR compliance and the steps you need to take now

10:10- 10:20 Break

10:20-11:00 Leigh Wood, Node IT Solutions
Why Cyber Security should be central to your GDPR strategy

11-11:20 Q&A with Mel & Leigh

This event is for you if

  • You are a Business Owner/Director who needs to understand how GDPR & Cyber Security impact your business
  • You have responsibility for ensuring your business is GDPR-compliant

Join us to find out what your business needs to know about GDPR and Cyber Security and start taking positive steps towards GDPR compliance. Click HERE to register for this FREE business briefing.


Will ISO 27001 make me GDPR compliant?

ISO27001 v BS 10012

On its own No – this is a myth.

Information security is just one of Six principles of BS10012 and GDPR

 “f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.”

Whilst a very important principle, if you rely on just having ISO 27001 for GDPR compliance you run the risk of not being in full alignment with all the principles (and related articles and recitals).


Who needs to be involved in BS 10012?

Do all my staff need to be involved in BS 10012

Successful implementation is a team effort.

It starts with the top – Senior Management need to be fully onboard and committed to achieving data protection best practice.  If this is secured, then everything else will flow from there.

In order to effectively identify all the personal data within your organisation you need to involve all areas of the business.

All too often businesses are concerned with just the data they may process for their clients – normally because they’re being questioned about data protection by their clients!

Or on the flip side, businesses are overly concerned with staff or finance data – excluding all the other client related personal data they may be controlling in the business.

With BS10012 – all personal data is captured and recorded to ensure that all risks are considered.

Thereafter, all staff require a level of data protection training to ensure that they understand their responsibilities in relation to personal data.  Unfortunately, as has been proven many times before, people will always be the weakest link when it comes to data protection breaches.  Ensuring all staff are trained is fundamentally one of the most important steps to take in implementing BS10012:2017

This extends out to key suppliers or partners depending on whether personal data is shared/ transferred outside of the business.

GDPR Law banner

GDPR becomes law on May 25th 2018.  Therefore compliance to the requirements becomes a legal implication for your business on this date.

Steve wood, the Information Commissioner’s Office Head of International Strategy & Intelligence has quashed any suggestions of a soft start to GDPR. He stated “You will not hear talk of grace periods from people at the ICO. That’s not part of our regulatory strategy.”  He explained the ICO intend to focus on risk and will be happy to work with organisations if there are any areas that seem unclear but there will be no grace period.

Law icon

Why do all my employees need to know about GDPR?

It is VITAL that all staff are made aware of GDPR and their responsibilities for Data Protection within your organisation. Even with the most stringent automated controls in place, ‘people’ will always be your weakest link (and greatest risk) in terms of data protection.

Therefore you need to ensure you are planning your GDPR awareness campaign now to ensure that your staff understand:

  • the requirements of GDPR,
  • What your expectations are as an employer and
  • What controls and processes are in place that must be adhered to
  • How to recognise and report a data breach
  • Who to speak to regarding Data Protection

Question mark

Why is GDPR being put in place?

The introduction of GDPR is an evolution of the existing UK data protection law (rather than a revolution). One of the key drivers for data protection change is the importance and continuing evolution of the digital economy in the UK and around the world. The digital economy is primarily built upon the collection and exchange of data, including large amounts of personal data – much of it sensitive. Growth in the digital economy requires public confidence in the protection of this information.

The major shift with the implementation of the GDPR will be in giving people greater control over their data. This has to be a good thing.


ISOlogist logo

Consultancy service

Let us do it for you

ISOlogy hub logo

Online membership

DIY with our isologyhub

About Blackmores

Our 7 Steps to Success

The Blackmores ISO Roadmap is a proven path to go from idea to launching your ISO Management System.

Whether you choose to work with one of our isologist consultants or work your own way through the process on our isology Hub, we’re certain you’ll achieve certification in no time!

What our clients have to say

The support and advise I get from our assigned auditors is immense. Forward planning for the following year is great and they are flexible and always willing to help.

Kalil Vandi

“Blackmores have assisted us almost since the start of our adoption of the ISO 9001 quality standard. Their input has improved our processes since the start, and enabled our goal of continuous improvement to be achieved. The people are also extremely easy to get on with, and they really understand our business, giving us a great deal of confidence in their advice.”

David Gibson

Photon Lines Ltd

“Blackmores are the perfect bridge between working on your ISO as an individual or company, to being audited each year.  We find that any queries we have are covered and we feel sure that we have everything as needs be before going into an external audit.”

Mandy Welsby

Jaama Ltd

“We have been extremely impressed with the service and support provided by Blackmores.  There knowledge and assistance through out our ISO journey has been amazing!”

Philip Hannabuss

Dome Consulting

“Blackmores have really kept us on our toes with the broad scope and level of detail they apply to our internal audit schedule. They always stay abreast of ISO standard changes and help us to adapt our processes and documents to embrace these changes accordingly. Having Blackmores shadow our external audits provides invaluable confidence and peace of mind – would highly recommend their services!”

Phil Geens

Kingsley Napley

“Our ISO 27001 certification project has gone so well, that there was no doubt in who we were going to ask to help us with our aspirations of becoming ISO 14001 certified. It’s been an absolute pleasure working with Blackmores, and we are really looking forward to working with them for the foreseeable future.”


Trusted by leading organisations across all sectors, we support companies of all sizes in any location.

Are you ready to start your ISO journey?

ISO Show

Listen to our Podcast

Welcome to the ISO Show podcast, dispelling myths and sharing tips for success to improve your business with ISO Standards. Join us to hear interviews with successful business leaders as they share their ISO journey with you.

Get top tips via audio master classes “ISO Steps to Success” on the most popular ISO Standards.


Carbonology logo

Ready to go carbon neutral... And achieve ISO Standards?

Welcome to Carbonology®

The proven method for achieving your carbon goals, aligned with ISO 14064 (carbon verification) and PAS 2060 (carbon neutrality)

Blackmores Carbon Neutral       Blackmores Carbon Footprint