Client Blog: GDPR – Time to Start your Journey to Compliance!


If you haven’t done so already, now is definitely the time to start your planning in respect of GDPR.
GDPR is the General Data Protection Regulation, which is already in place in the UK. However, it will come info force from 25th May 2018 – by which time your organisation truly does need to be compliant and to have a framework in place which demonstrates this.
Furthermore, in case you are waiting to see what happens in respect of Brexit – don’t. Whether the UK remains in the EU or not will make absolutely no difference. As of May 2018, your data should be secure and your systems should support privacy by default.
The ICO (Information Commissioner’s Office) will be in a position to impose stiff administrative fines on those who exhibit serious data protection failings. With fines starting at €10m or 2% of the previous year’s global turnover (whichever is the higher), these are no “slap on the wrist”.
In addition, on top of the above fines, organisations must take into consideration the other very real negative impacts involved if you suffer a cyber attack. If you lose the personal data of your clients through a preventable breach, you will be liable for compensation to the victims (which can often dwarf the amount of an administrative fine). In addition, the bad publicity will frequently result in a significant loss of customers and drop in sales.
Top tips for GDPR compliance planning:
  • Involve your senior management team and appoint a senior manager to lead the project
  • Perform a full information audit to review where all data is currently kept (in any format) for all departments – sales, customer relationship management, marketing, HR, etc
  • Consider what information actually needs to be kept (because of a legal or legitimate basis) and what can be disposed of (in particular out-of-date or inaccurate data)
  • Produce a compliance plan so there are systems, processes and procedures in place to ensure appropriate consent is always gained. Everything needs to be documented and you need to have a clear audit trail of consent
  • Be transparent on how you are using personal data and only use the data for the purpose stated
  • Ensure all Data Processors (organisations storing and/or processing data for you) are also compliant – technical support, website designers, eMarketing software, CRM systems, HR management systems, etc
  • Speak to your solicitor for up-to-date legal advice
#58communications #blog #blogging #blogpost #marketing #communications #content #Midlands

Comments

Popular posts from this blog

Client Blog: Talent Retention: the Gold Star of Successful HR

Client Blog Post: MAKUP Academy - Exceptional Training and Unique Support Leads to Student Work Opportuniities and Achivements:

Client Blog: Bursaries and Incentives on Offer to Attract Trainee Teachers