GDPR what you need to know and how this affects your Business


I am only a small business employing less than 20 people, why should I be concerned?
If you process personal data, you are expected to comply with the GDPR regardless of the size of your business.
What immediate steps should I take to get ready?
- Although not mandatory for every organisation, it would be prudent to nominate a responsible person to undertake the role of a Data Protection Officer (DPO). This person will conduct the necessary privacy impact assessment if necessary for your organisation. Article 37(1) of the GDPR requires the designation of a DPO in three specific cases:
- (a) where the processing is carried out by a public authority or body;
- (b) where the core activities of the controller or the processor consist of processing operations, which require regular and systematic monitoring of data subjects on a large scale;
- (c) or where the core activities of the controller or the processor consist of processing on a large scale of special categories of data.
- However, any organisation can appoint a DPO to act as a contact point for Data issues.
- As well as nominating a DPO, ensure key people in your organisation are aware of the GDPR and the obligations;
- Review the current security of your personal data, who has access to it and how safely this is stored;
- Review how you seek consent from employees or job applicants.
- Consider how long you need to retain personal data and whether or not you should be erasing personal data which is of no longer any value to the parties.
What is the deadline for compliance?
25 May 2018
What is GDPR?
GDPR is the General Data Protection Regulation. The GDPR will involve substantial changes to the Data Protection Act 1988 (DPA 1988). It will result in the repeal of Directive 95/46/EC, the Data Protection Directive which will no longer exist following the implementation of the GDPR.
How does GDPR affect me as an employer?
From an employer’s perspective, one of the major changes involves how you seek record and manage consents for employees and for job applicants’ personal data. You will need to review your policies to ensure they are compliant with GDPR. This means you will have to draft a Data Protection Notice and seek informed consent from your employees and job applicants. A Data Protection Notice will include key information to employees and job applicants for instance: how you store their data, how they may access their data, how long you keep the data, how you keep such information secure and how they may complain if the storage and processing of their data is wrong.
What is ‘Personal Data’?
‘Personal Data’ under the GDPR means any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier. So, what does this mean? Well, it applies to a wide range of personal identifiers constituting personal data, including name, identification number, location data or online identifier, reflecting changes in technology and the way organisations collect information about people.
The GDPR also applies to both automated personal data and to manual filing systems where personal data are accessible according to specific criteria. This could include chronologically ordered sets of manual records containing personal data.
Personal data that has been pseudonymised – e.g. key-coded – can fall within the scope of the GDPR depending on how difficult it is to attribute the pseudonym to a particular individual.
Pursuant to Article 9, personal data also includes data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.
What happens if I don’t comply by the deadline?
A failure to comply with the GDPR may have major consequences for employers. Under the Data Protection Act 1988 the maximum fine the ICO can impose a fine of £500,000 to Data Controllers. Under the GDPR the fine is divided into 2 levels. Level 1 the ICO can impose a fine of up to 10 million euros or 2% of annual global turnover or whichever is the higher. For more egregious breaches under level 2, the ICO impose a fine of up to 20 million euros or 4% of annual global turnover whichever is higher. It is important to note that whilst compliance is important, where there is a breach, fines are not mandatory but discretionary and will be imposed on a case by case basis. There will also be a range of sanctions designed to motivate compliance such as warnings, reprimands, and corrective orders which will not carry a financial penalty but may harm the reputation of a business.
Are there any changes to how you must respond to data subject access requests?
Yes, under the GDPR, you no longer have 40 days to comply with a data subject access request. Information must now be provided without delay and at the latest, within one month of receipt. You may be able to extend the period where requests are complex and numerous. However, this must be set out in a response to the individual making the request, explaining why the extension is necessary. There is no longer an automatic right to charge a fee. You MUST provide the information free of charge. However, you can charge a ‘reasonable fee’ when a request is obviously unfounded or excessive, particularly if it is repetitive. You may charge a reasonable fee to comply with requests for further copies of the same information. This does not mean that you can charge for all subsequent access requests. The fee must be based on the administrative cost of providing the information.
For further useful information, the Information Commissioner’s Officer (ICO) have published a 12 step guide to assist with GDPR obligations see link below:
https://ico.org.uk/media/1624219/preparing-for-the-gdpr-12-steps.pdf







