Are you ready for the GDPR?

The new General Data Protection Regulation (GDPR) affects all businesses, in varying degrees, based on the sorts of information you collect about customers, clients and employees, and whether you have obtained permission to hold this information.

To try and decipher the legislation and what your responsibilities are can be a bit of a mine field, especially with the inevitable grey areas in new legislation. You need to comply, whilst remaining commercial in your decision-making about how to implement measures that protect your business.

Key points to note are that you must obtain permission from all of your contacts, before 25^th May, to continue to contact them in future and record their preferences. If a contact wishes to be removed from your database, you must comply with this.

We have put together a few guidelines of steps you can take to achieve compliance, as recommended by the ICO (Information Commissioners Office) going forward:

• Take a look at the 12 steps to take right now on the ICO’s website
• You may also want to look at the guide covering all aspects of GDPR
• It is also important to determine if you are holding data based on ‘legitimate interest’. The ICO has also created some guidance on how to conduct legitimate interest assessments and how to consider if legitimate interest can be used as the basis of holding and processing data. It is useful to conduct a test for each type of data processing activity that is carried out, as follows:
  • Identify the legitimate interest – what is the purpose of processing the data?
  • Carry out the necessity test – is the data processing necessary to achieve organisational objectives?
  • Carry out a balancing test – is processing the data likely to negatively impact the individuals rights?
  • Organisational risk – are there implications to your business, whether legal, operational or reputational?

Please note, this article is for information purposes, and we suggest for any specific advice required relating to your business, that you seek the appropriate legal guidance.