Menu Close

Data Security – Data Protection Regulation — Ensuring Compliance

Roles and Responsibilities

In the run up to GDPR you will have con­sid­ered if you need­ed to for­mal­ly appoint a DPO – a neces­si­ty if:

  • You are a pub­lic author­i­ty or body; or
  • Your core activ­i­ties require large scale, reg­u­lar and sys­tem­at­ic mon­i­tor­ing of indi­vid­u­als; or
  • Your core activ­i­ties con­sist of large-scale pro­cess­ing of spe­cial cat­e­gories of data or data relat­ing to crim­i­nal con­vic­tions and offences.

Many organ­i­sa­tions chose to ensure that an indi­vid­ual or depart­ment has respon­si­bil­i­ty for pri­va­cy activ­i­ties with­out the need for a for­mal DPO appoint­ment. Ensur­ing that the roles and respon­si­bil­i­ties for data pro­tec­tion are well known and doc­u­ment­ed in your organ­i­sa­tion is a key com­pli­ance require­ment.

ROPA — Record of Processing Activities

Doc­u­men­ta­tion of the pro­cess­ing activ­i­ties car­ried out by the organ­i­sa­tion is a require­ment of Arti­cle 30 of the GDPR (both UK and EU) if your organ­i­sa­tion has over 250 employ­ees. It is also a require­ment for small­er com­pa­nies if the data you process:

  • are not occa­sion­al
  • are like­ly to impact the rights and free­doms of indi­vid­u­als; and
  • involve spe­cial cat­e­go­ry data or crim­i­nal con­vic­tion and offence data.

Your ROPA should con­tain a data map of your sys­tems that con­tain per­son­al data along with infor­ma­tion on the law­ful basis of pro­cess­ing, the pur­pos­es and meth­ods of pro­cess­ing data, data shar­ing and data reten­tion poli­cies and pro­ce­dures.

It is impor­tant to ensure that there are reg­u­lar reviews of this doc­u­men­ta­tion as updates are like­ly over time.

There is fur­ther guid­ance from the ICO on ROPA best prac­tice.

Policies and procedures

Your poli­cies and pro­ce­dures should clear­ly out­line roles and respon­si­bil­i­ties in your organ­i­sa­tion cov­er­ing a num­ber of pri­va­cy relat­ed areas:

  • Data Pro­tec­tion and records man­age­ment
  • Infor­ma­tion secu­ri­ty includ­ing breach­es and inci­dent man­age­ment
  • The pro­vi­sion of infor­ma­tion fol­low­ing indi­vid­ual rights requests – such as sub­ject access requests and infor­ma­tion notices
  • Data Pro­tec­tion by design and default to ensure issues are con­sid­ered and doc­u­ment­ed (Pri­va­cy impact assess­ments) when new sys­tems, ser­vices, prod­ucts and process­es are imple­ment­ed, or exist­ing ones amend­ed
  • The pri­va­cy pol­i­cy on your web­site should be reviewed reg­u­lar­ly and the date of last update clear­ly dis­played

Supplier Management

It is essen­tial that con­tracts are in place with organ­i­sa­tions that process data on your behalf. Con­tracts should set out the details of pro­cess­ing includ­ing:

  • The sub­ject mat­ter of the pro­cess­ing
  • Dura­tion of the pro­cess­ing
  • Nature and pur­pose of the pro­cess­ing
  • Type of per­son­al data and cat­e­gories of data sub­jects
  • If any sub-proces­sors are used.

A frame­work of due dili­gence checks to ensure that these organ­i­sa­tions are oper­at­ing the appro­pri­ate tech­ni­cal and organ­i­sa­tion­al require­ments to meet GDPR is need­ed.

Reg­u­lar­ly review­ing the con­tracts and data shar­ing agree­ments you have in place with oth­er organ­i­sa­tions is rec­om­mend­ed.

Training

Mak­ing sure your staff are aware of their respon­si­bil­i­ties with regard to pro­cess­ing per­son­al data is key. Induc­tion and refresh­er train­ing should include infor­ma­tion on data pro­tec­tion, poten­tial secu­ri­ty threats and your organisation’s infor­ma­tion gov­er­nance poli­cies and struc­tures. Mon­i­tor­ing and doc­u­ment­ing train­ing com­ple­tion is an impor­tant ele­ment in being able to demon­strate your com­pli­ance.

Other laws and regulations

There are var­i­ous oth­er Acts and reg­u­la­tions in the UK which have a bear­ing on data secu­ri­ty. These include:

  • Pri­va­cy and Elec­tron­ic Com­mu­ni­ca­tions Reg­u­la­tions (PECR) 2003 — which cov­er ‘spam’ and mass-mar­ket­ing mail­shots. Reg­u­la­tions under the PECR are also issued from time to time. For exam­ple, reg­u­la­tions on the use of cook­ies on web­sites, and in 2016 to require any­one mak­ing a mar­ket­ing call to dis­play their num­ber
  • Copy­right Design and Patents Act — amend­ed in 2002 to cov­er soft­ware theft
  • There may be oth­er IT stan­dards and reg­u­la­tions applic­a­ble: for exam­ple, com­pa­nies pro­cess­ing cred­it card trans­ac­tions need to ensure com­pli­ance with the Pay­ment Card Indus­try Data Secu­ri­ty Stan­dards (PCI DSS).

Sources and links

ICO home page for organ­i­sa­tions

EU GDPR por­tal — www.gdpreu.org