Blackmores ISO Consultancy Service: The creators of isology®

All companies have a legal obligation to comply with existing legislation – it’s the law!

Failure to comply to legal requirements can be costly in terms of fines and reputational damage if an incident occurs. So, it’s in your best interest to ensure you can identify all applicable compliance requirements.  

Most ISO’s specify a requirement to identify legal compliance requirements, and in our experience, the most effective way to do so is through the creation of a Legal Register.

Mel is joined by Sarah Ball, A QHSE Consultant here at Blackmores, to discuss how you can create your own Legal Register and keep up-to-date with changes in legislation.

You’ll learn

• The importance of Legal Compliance
• How to identify what legislation is applicable to you
• What is a Legal Register?
• How can you create a legal Register?
• How can you keep up with changes in Legislation?

Resources

• isologyhub
• Legislation.gov
• Productivity Ninja

In this episode, we talk about:

[01:06] Why do you need to comply with Legislation – quite simply, it is the law! It can be very costly for you in both a financial and reputational respect.

[01:25] There is a requirement for identifying legal compliance requirements in most ISO’s i.e. ISO 45001 (Health and Safety) and ISO 14001 (Environmental)  

[02:33] A Legal Register is not a requirement of any ISO – but we find it is the most effective way of documenting and keeping track of changes in applicable legislation.

[03:05] Why is it so important to manage legal compliance? Besides the financial and reputational cost of not complying with the law – it’s a way to protect your business. The law is there for a reason and it is often times to protect individuals or communities.

[04:35] You will need to take a proactive approach to find out what legislation is applicable to you.

[05:40] How can you identify your legal obligations? Firstly, do some basic research, start by visiting reputable industry authorities as they will likely have some guidance available i.e. The HSE Website or the Legislation.gov website. There are also subscription services available that give you an overview of what may be applicable to you and notify you of any updates. Finally, you can look to a specialist consultancy to help you.  

[09:05] We do have a module on Legal Compliance available in the isologyhub!  

[10:05] Why is it important to have a legal register? You will have to keep track of a lot of legislation! By documenting it, you have full visibility and can identify any gaps. You can also assign accountability against each piece of legislation, so the responsibility can be shared and managed.

[11:40] Your brain is for thinking and processing, not remembering. By documenting information, you create a ‘second brain’ to free up your brain for more important tasks – We recommend checking out the ‘Productivity Ninja’ series of books for more helpful organisation and prioritisation tips!  

[12:28] What does a Legal Register look like? It’s typically a table of information – we use spreadsheets but any format is fine. Key columns we use identify the name of the legislation or contractual obligation, a link to the legislation, the requirements and purpose (what does this legislation mean to you?), A link to any further guidance and description of what good looks like to you i.e an example of evidence of compliance. You could include a column for accountability.

[16:00] How do you create a Legal Register? First, set up your table, next go out and find your applicable legislation, confirm and document your requirements in regard to the legislation, then assign accountability within the organisation. You may want to consult stakeholders to complete the obligations and figure out what good looks like. It is also good practice to do a legal compliance audit to ensure you are meeting obligations and identify any gaps.

[17:50] You can document other requirements in the Legal Register – this can include Service Level Agreements or even any ISO standards you’re certified to. It is advised to add any contractual requirements with customers or possibly landlords or suppliers. If you are a trade body that has a code of conduct, we recommend you include that too.

[21:00] Sarah’s top tip: When creating new processes or updating existing ones, it’s always good to look back at the Legal Register and check that any changes you’re making aren’t going to affect anything in terms of compliance.  

We’d love to hear your views and comments about the ISO Show, here’s how:

• Share the ISO Show on Twitter or Linkedin
• Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

Stitcher | Spotify | YouTube | iTunes | Soundcloud

Will ISO 27001 make me GDPR compliant?

ISO27001 v BS 10012

On its own No – this is a myth.

Information security is just one of Six principles of BS10012 and GDPR

 “f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.”

Whilst a very important principle, if you rely on just having ISO 27001 for GDPR compliance you run the risk of not being in full alignment with all the principles (and related articles and recitals).

Who needs to be involved in BS 10012?

Do all my staff need to be involved in BS 10012

Successful implementation is a team effort.

It starts with the top – Senior Management need to be fully onboard and committed to achieving data protection best practice.  If this is secured, then everything else will flow from there.

In order to effectively identify all the personal data within your organisation you need to involve all areas of the business.

All too often businesses are concerned with just the data they may process for their clients – normally because they’re being questioned about data protection by their clients!

Or on the flip side, businesses are overly concerned with staff or finance data – excluding all the other client related personal data they may be controlling in the business.

With BS10012 – all personal data is captured and recorded to ensure that all risks are considered.

Thereafter, all staff require a level of data protection training to ensure that they understand their responsibilities in relation to personal data.  Unfortunately, as has been proven many times before, people will always be the weakest link when it comes to data protection breaches.  Ensuring all staff are trained is fundamentally one of the most important steps to take in implementing BS10012:2017

This extends out to key suppliers or partners depending on whether personal data is shared/ transferred outside of the business.

If you would like more help understanding these certifications – then contact Blackmores today!