GDPR: What action should you be taking now in your business?
16i, a Cheltenham-based digital design agency, has outlined what businesses need to be doing now if they want to be ready for the incoming General Data Production Regulation (GDPR).
Almost all businesses will have to take action to ensure they comply with the legal requirements around people’s personal data, with GDPR set to come into force in May 2018.
While GDPR has received a lot of press coverage, not everyone is aware of the changes. Businesses need to make sure to raise the topic with their team to ensure they know about both the risks – and the opportunities.
GDPR will require suppliers and customers to review supply chains and current contracts, so renegotiations may be required. Equally, commercial terms will inevitably have to be revisited given the increased costs of compliance and higher risks of non-compliance.
An important step towards compliance is to review an organisation’s data flow. This allows firms to identify the location, access and ownership of data; whilst classifying the type of data an organisation holds.
What ‘personal’ data is being processed?
Are existing processing methods compliant?
Where is data being held and how does it flow through the organisation?
Are there adequate controls in place surrounding movement and storage?
Who in the organisation owns the data?
Who, if anyone, is it being shared with, both internally and externally?
Most organisations carry out some form of data sharing, typically between either group organisations or with external third parties. However, if the data being shared is ‘personal data’, additional steps will need to be taken to ensure individuals are provided with all the relevant information (relating to how the data is shared) at the right time.
Once data flows and protocols have been assessed, any personal data which is no longer required should be cleared out. The less personal data held, the easier compliance will be (although records should be made of which data was removed and why).
Are businesses truly aware of the effects of GDPR?