We can hide from it but truth is the new General Data Protection Regulations (GDPR) are coming into effect on 25th May 2018, these new regulations affect the personal data that every business processes, further more the definition of Personal Data has changed.

What is the definition of Personal Data?

The GDPR changes the definition of personal data, it is fair to say that information you would previously not have classified as Personal Data will be under the GDPR.

What do you need to do?

This is different for every business but there is some common ground, the very first thing that you need to do is a DPIA (Data Protection Impact Assessment), in its simplist form this is a list of all the different types of personal data you process, why you process it, on what legal basis you process and how you protect and manage it, you may remember from a previous post we described the GDPR as a “risk based regulatory framework”, with that in mind you need to put policies and procedures into place to reduce your liability by reducing any potential damages to the rights and freedoms of any person.

Once you have your DPIA then you can question if you actually need the data and then minimise the personal data that you hold and protect it.

Security by design

GDPR states that security should be by design and with the current technologies available but without involving unrealistic costs, some of the security measures you can implement can be done very cost effectively, for example ‘Access Permissions’ only giving access to those that actually need access, another measure may be disk encryption, if enabling disk encryption then there are some specific guidelines from the NCSC (National Cyber Security Centre) which should be implemented, if you need assistance implementing protection then please get in contact.

GDPR is the General Data Protection Regulations (GDPR) that come into effect on 25th May 2018, it is the biggest change to Data Protection in 20 years and is long overdue, the amount of personal data we process and the way we process it has changed vastly and all businesses need to demonstrate that they care and respect the data they are privileged to maintain, the GDPR is best described as a “risk based regulatory framework”, you need to asses your risks to the data and then put monitoring, detection and response controls in place, these come in many forms.

For most businesses the change is actually not that big, it would be fair to say that most respectful businesses already treat the Personal data they maintain with respect and care but have not documented how they maintain the data and how to put things right, the GDPR puts a requirement on businesses to have a clear and concise Data Protection Policy in place and then demonstrate how the policy is applied.

What is Personal Data

The GDPR changes the definition of personal data, it is fair to say that information you would previously not have classified as Personal Data will be under the GDPR.

Can I still process Personal Data?

Of course you can, but you must have a Lawful Reason to process the data, there are 6 lawful reasons for processing data, there is no hierarchy to the reasons.

Everyone is talking about big fines!

There is no hiding from the fact that the GDPR does include provision for some hefty fines, as we have said the GDPR is a “risk based regularity framework” the implementation of the GDPR in your business is all about mitigating those fines with you monitoring, detection and response controls, however it is worth noting that Elizabeth Denham of the Information Commissioners Office (ICO) has consistently said she “would rather use the Carrot than the Stick” and fines will be a last result saved for persistent offenders and serious cases. the ICO have

What do I need to do?

The very fist thing you need to do is asses what Personal data you hold, how has access to it and where it is going, then you need to risk asses the data and implement monitoring, detection and response controls, these will vary depending on the data and how much control you have over those controls, this is know as a Data Protection Impact Assessment.