The governance and accountability of data controllers
The GDPR places onerous accountability obligations on data controllers to demonstrate compliance and there are a number of unwelcome, yet essential administrative burdens placed on data controllers. As a data controller you will have to:
• Provide comprehensive, clear and transparent information to individuals regarding the processing of personal data and their rights.
• Maintain documentation regarding your processing activities.
• Implement technical and organisational measures to demonstrate that you have considered and integrated data protection into your data processing activities.
• Conduct privacy impact assessments (PIAs) where the processing is likely to result in a high risk to an individual’s rights and freedoms.
• Have processes in place for the notification of data breaches. Data breaches must be notified to the appropriate Regulator – in the case of the UK, the ICO. This must be done without undue delay and, where feasible, within 72 hours of being aware of the breach. The data breach threshold requiring notification to the data subjects themselves is where their rights and freedoms are placed at a “high risk”.
Steps to take to ensure you are compliant
Even though some months off still, you should start taking steps now to ensure that you are ready. The accountability principle means that the onus is on you and your business to be proactive in protecting individuals’ data and avoiding breaches.
1. Awareness of the new regulation. Make sure that you and others in your organisation are familiar with the requirements of GDPR.
2. Perform an audit. Carry out an audit of the personal data that you hold. Track the data flows in order to identify what personal data you hold, where the personal data has been obtained from, the legal basis on which you are holding it and where the personal data goes.
3. Privacy Information and Notices. Review your current privacy notices and put a plan in place to make any necessary changes.
4. Consents. Check to see that if you are relying on consent for data processing that it meets the new requirements. If you use pre- ticked boxes to obtain consent for marketing information, this will need to be changed.
5. Contract Documentation. Ensure you audit any existing supplier agreements that you have in place and update data processing/protection provisions in your standard agreements and tender/ contract documentation.
6. Check Procedures. Check your procedures to ensure that they allow for compliance with the data breach notification requirements as well as all the new applicable rights conferred to individuals under the GDPR, including the deletion or removal of information and subject access requests.
7. Privacy Impact Assessments (PIA). Identify whether you need to carry out any PIAs and familiarise yourself with the requirements.
8. Cross Border Operations. If you operate in more than one European country, decide which is the relevant data protection authority for your activities. Also if you transfer or process personal data outside the EEA, you need to identify the mechanism that you rely on to do so and watch out for any changes that may occur over the coming few months/years regarding cross-border data transfers.
Now whilst this may all seem over the top and very challenging, it is. If all this ‘red tape’ is beyond you, then IIMS advises you to get specialist advice from those in the know. An internet search will find a good selection of organisations who are making it their business to help your business in this area. Make sure you are compliant and ensure you are not in the first batch of test cases that are certain to follow the implementation date in May 2018 for organisations flouting the regulation.
The Report • December 2017 • Issue 82 | 63
Steps to take?
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36 |
Page 37 |
Page 38 |
Page 39 |
Page 40 |
Page 41 |
Page 42 |
Page 43 |
Page 44 |
Page 45 |
Page 46 |
Page 47 |
Page 48 |
Page 49 |
Page 50 |
Page 51 |
Page 52 |
Page 53 |
Page 54 |
Page 55 |
Page 56 |
Page 57 |
Page 58 |
Page 59 |
Page 60 |
Page 61 |
Page 62 |
Page 63 |
Page 64 |
Page 65 |
Page 66 |
Page 67 |
Page 68 |
Page 69 |
Page 70 |
Page 71 |
Page 72 |
Page 73 |
Page 74 |
Page 75 |
Page 76 |
Page 77 |
Page 78 |
Page 79 |
Page 80
