GDPR, Data & Privacy Advice for Technology Enabled Businesses

Whenever you collect and use identifiable personal data about customers or a client (like name, email, address and preferences) you need to stay compliant with the law.

If you don’t comply, you can be fined by the regulator (the ICO - Information Commissioner’s Office) – up to 4% of your turnover. Or, even more worryingly, the ICO can issue a ‘Stop Now’ order, which prevents you from collecting or using personal data at all, either permanently or until you have complied with their requirements.

The GDPR requires organisations who process personal information (known as “personal data”) relating others to keep that data safe, and to only process the data if they have lawful grounds to do so.

In summary, the GDPR obliges organisation who processes personal data to protect that personal data and only process it if they have lawful grounds to do so (including being transparent about what data is held and why and what is done with it, only processing the data for the purpose for which is was collected, only processing – collecting- the minimal amount of data needed for the lawful processing and making sure that the organisation has appropriate technical and organisational measures in place to protect .

The GDPR applies to all organisations (which includes sole traders, charities, partnerships and limited companies) who have a branch in an EU member state or if the organisation is based outside the EU, then if that organisation either “processes” personal data in the European Union or if customer, employees, users etc are based in the EU. “Processing” includes if the data is in transit, stored, or otherwise.

Individuals have the right to know what organisations are doing with their personal information, who that information is shared with, how long it is stored for etc.

They also have various rights of access to that information including:

• Access

• Rectification

• Erasure (‘Right to be Forgotten’)

• Restriction of processing

• Portability (in a format to enable transfer)

• Object to processing

• Automated decision making, including profiling.

Understanding the complexities of the GDPR can be difficult and many businesses think it only covers personal information relating to their staff. Data protection also includes your customers’ and suppliers’ personal data and any data you are storing or managing for a third party.

We advise businesses on:

• Data Audit

• Data Asset Register

• Data Protection Policies and Procedures

• How to handle subject access requests (SAR / DSAR)

• Individuals’ data rights

• Dealing with data breaches, including reports to the ICO

• Handing complaints from individuals and regulators

• Moving data out of the EEA

• Sharing data with other businesses

The data protection principles set out the rules you need to follow when using personal data. You must make sure the information is:

• processed fairly, lawfully and transparently

• processed for specified, explicit purposes

• processed in a way that is adequate, relevant and limited to only what is necessary

• accurate and, where necessary, kept up to date

• kept for no longer than is necessary

• handled in a way that ensures appropriate security, including protection against unlawful or unauthorised processing, access, loss, destruction or damage

GDPR introduced a new ‘accountability’ principle. It means you are responsible for what you do with personal data and how you comply with the data protection principles.

What else you need to do will depend on how much and what type of data your practice controls.

• Carry out an audit of the information you hold. Consider why and how long you hold this data. Implement a compliant data protection policy;

• Update privacy notice on website and for all staff;

• Review marketing processes and cleanse data where consent is needed;

• Update all contracts with third parties, and terms and conditions to ensure GDPR compliance;

• GDPR training/awareness for staff;

• Ongoing audits.