T: 01787 468512 | E: enquiries@ea-learningtech.com

GDPR – What’s it all about?

  • On 26th October 2017

Just in case you weren’t already aware, GDPR (or the General Data Protection Regulation) is the hot topic of the moment as many organisations begin to prepare for the changes, which will be coming into force in May next year. The GDPR looks to provide better protection to data subjects (you and I) in a fast-paced digital world where data is king.

The new regulation will supersede the current Data Protection Act and builds on the existing legislation. The way in which organisations use data has changed so much over recent years, and the new approach will modernise the way data is handled and bring this into the 21st Century.

Here are 10 key facts about the GDPR which you may need to consider before beginning to implement any changes.

  1. The new regulation was introduced in 2016, however organisations have until 25th May 2018 to be compliant
  2. GDPR will look to change the way organisations collect, store, process and protect personal information for their clients, employees and customers
  3. Leaving the EU will have no impact on whether or not the GDPR regulations come into force, special considerations need to be made for companies trading internationally
  4. The GDPR applies to all companies across the globe who process personal data of EU citizens
  5. DPA consent isn’t enough. As stated in article 4 of the GDPR “…any freely given, specific, informed and unambiguous indication of his or her wishes by which the data subject, either by a statement or by a clear affirmative action, signifies agreement to personal data relating to them being processed”. This means customers will need to opt into an agreement voluntarily with an organisation, which has been clearly explained and states how data will be handled, there must not be an automatic enrolment where customers have to opt out
  6. Accountability is key, organisations will need to understand any risks they create for data subjects and mitigate those risks. There will need to be a better approach to governance and compliance with robust processes in place
  7. Organisations will need to have a dedicated Data Protection Officer if they fall into the following categories: a public authority, carry out large scale tracking or carry out large scale processing of special categories of data or data relating to criminal convictions and offences
  8. Mandatory privacy impact assessments (PIAs) will be introduced, meaning data controllers will need to conduct PIAs where the risk of privacy breaches is high to minimise any risks to data subjects
  9. Data breaches will need to be notified to the local data protection authority within 72 hours of it being discovered, organisations will therefore need to ensure their technology and employees are able to detect these breaches effectively
  10. The way in which data can be held by organisations is changing. GDPR means companies can only keep data for as long as it remains absolutely necessary and can only use the data for the original purpose it was collected. If companies wish to use it for a different purpose they will need to obtain permission from the data subject. Data subjects also have the right to be forgotten, which means they can ask to have all of their data deleted, which must be adhered to.

Contact us to preview our latest GDPR course bundle

0 Comments

By continuing to use the site, you agree to the use of cookies. more information

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.

Close