What is the GDPR?
Firstly, the GDPR affects every business that holds personal information on anyone, be they employees, customers or suppliers. It is a rare business that does not hold a list of personal data of some kind, on or offline.
The General Data Protection Regulation (GDPR) is a legal directive from the European Union for the protection of such personal data. It seeks to address the inconsistent data protection laws currently existing throughout the EU’s member states. Despite Brexit, the UK is still bound by this new law, not only because the UK has chosen to (because it makes sense) but trading with countries who operate under GDPR will be compromised if we don’t uphold the same standards.
What’s the big deal?
Failure to comply with GDPR could mean you risk being fined up to 4% of your company’s global annual turnover. Not only could your business suffer financially but you could also damage your reputation and credibility – who wants to do business with an organisation that doesn’t prioritise its clients’ security?
So begins the 12 month countdown…
What should you be doing?
You must:
- Keep a record of data operations and activities and consider if you have the required data processing agreements in place
- Carry out privacy impact assessments (PIAs) on products and systems
- If applicable to your organisation, designate a data protection officer
- Review processes for the collection of personal data – do you ask permission? Many CRM systems encourage a dual confirmation (hence why you are asked to click a link via an email after registering with an organisation)
- Be aware of your duty to notify the relevant supervisory authority of a data breach
- Implement ‘privacy by design’ and ‘privacy by default’ in the design of new products and assess whether existing products meet GDPR standards
What else could help?
- Educate your staff – and explain the implications
- Set up internal systems for reporting a data breach
- Make sure you extend your GDPR preparation to include any third parties who may have access to your data
- Ensure you extend the policies to cover everything your store both offline and online
- A really powerful solution that we recommend is to use a secure client portal and NEVER use email to distribute information of any kind. A secure portal like docSAFE means data doesn’t leave the portal but can be accessed by authorised people only
And if you don’t?
There is a two-tier fine system that will kick in from May 2018. Tier 1 means that if a serious data breach occurs, putting data at risk, you will be fined up to £17.25m or 4% of the previous year’s annual global turnover – whichever is the greatest. Tier 2 can lead to fines of up to £8.6m or 2%, whichever is greater.
How can we help?
Talk to us. We are experienced in identifying the areas of your business that are vulnerable and need addressing for GDPR purposes. Not only that but we know how to implement layers of security for your business that go beyond government legislation. We care about protecting your reputation and credibility, especially for those in the professional sector whose business relies on discretion, the handling of sensitive documents and client protection.