GDPR, what you need to do – Part 2

The General Data Protection Regulation will come into force in all of the 28 Member States of the European Union (EU) on 25 May 2018. This will herald a significant change in the regulatory landscape for data protection giving EU citizens greater control of their personal data. The new Regulation directly affects both EU and non-EU based businesses as it applies to organisations processing and holding personal data of data subjects in the EU, regardless of the organisation’s location.

so what should you be doing ?

Due to the wide scope of GDPR it will cover more many more businesses than before.  If you have not already started getting ready, with 6 months to go before implementation, you need to be getting ready now.  So where do you start…? (If you missed them, you can read tips 1 to 5 in the first article here)  

6. Determine if you need to appoint a Data Privacy Officer (DPO). These are required when:
   1. Core activities require regular and systematic monitoring of data subjects on a large scale or
   2. Large scale processing of sensitive data

Research organisations generally collect personal data, including sensitive data, as part of their core activities, and they do this on a large scale so a DPO is likley to be needed by research organisations. MRS has some guidance on appointing DPOs.  

7. Build an organisation wide comprehensive privacy compliance programme and structure to ensure that all the necessary activities are completed.

 

8. Prioritise all areas within your business which have the highest risk and highest potential impact on your organisation, including areas with he highest fines such as consent, sensitive data and compatibility of systems with new rights.

 

9. Start undertaking Privacy Impact Assessments (sometimes called Data Protection Impact Assessments) for your activities. This is how privacy by design and default becomes embedded in your corporate thinking. These assessments should describe your data flows and identify and minimise compliance risks.  As a minimum the Assessment should include:
   1. A description of the envisaged data processing
   2. An assessment of the need for processing and risks to the data subjects
   3. Measures to mitigate these risk and to ensure GDPR compliance.

 

10. And lastly prepare for breach notifications. Set up internal procedures and strategies for data breach notifications, and processes for detecting breaches.

  Debrah Harding Managing Director, MRS