GDPR Services.

The General Data Protection Regulation (GDPR) is a new legal framework that applies in the UK from May 2018. Regardless of Brexit, The UK Government have confirmed that the decision to leave the EU will not affect the commencement of GDPR. If you currently comply with the UK Data Protection Act then most of your approach to compliance will remain valid for the GDPR, but there are some differences in the new regulation such as:

• The definition of personal data has been extended to include online identifiers such as IP addresses and cookies;
• Additional obligations on Data Controllers to ensure contracts with Data Processors comply with the GDPR;
• Consent requires some form of clear affirmative action and must be verifiable;
• New provisions for the protection of children’s personal data;
• New rights for individuals;
• Enhanced requirements for the implementation of comprehensive but proportionate governance measures to minimise the risk of breaches;
• A duty on all organisations to report certain types of data breaches;
• The Data Controller is responsible for and should be able to demonstrate compliance with the GDPR principles.

Our approach to GDPR is based on our experience of information security and helping ensure that good practice becomes part of ‘business as usual’. This requires senior management to recognise that personal information and ownership of the associated risks is their responsibility and not that of IT. The business owns the data, so the business needs to take accountability for data and manage those who access it. GDPR is about applying good practice and changing the behaviour of staff so that they instinctively do the right thing.

Our GDPR services include:

• Awareness training for senior management and staff
• Readiness assessments to establish your current level of compliance and identify what you need to do to comply
• Implementation support to develop the required processes, procedures and documentation for compliance
• Ongoing management and support to help maintain compliance
• Virtual DPO support
• Data protection advice line