Learning Zone 2020 - GDPR Series Conclusion
In the last post we looked at the rights of the data subject, lawful basis and the principles of data processing.
Now we can review some practical next steps to take on the journey towards compliance.
Becoming Accountable            Â
Recognising and owning the personal data you process in one of the best ways to begin your own businesses compliance journey:
 Carry out an inventory of all personal data you hold and examine it under the following headings:
¡       Why are you holding it?
¡       How did you obtain it?
¡       Why was it originally gathered?
¡       How long will you retain it?
¡       How secure is it, both in terms of encryption and accessibility?
¡       Do you ever share it with third parties and on what basis might you do so?
 The Isle of Man Information Commissioner has a hand pack that you could use as a starting point for your own inventory:
https://www.inforights.im/media/1271/gdpr_part-1_toolkit_mapping_may2016.pdf
 Documentation for Your Business
There is a list of documentation that youâll need to compile to meet your businesses obligations under the GDPR. Â You will probably need most of them but not all. Â If you donât have employees or deal with childrenâs data, you can reduce the list a little.
Again, there is no need to over complicate these, there are many examples online you could use to begin. Â
Also look at your competitors to see what they are doing in this space â how does their privacy notice on their website look for example â would you be satisfied with it as a customer or supplier etc.
You will need to invest some time upfront to get these foundational documents, policies and procedures in place. Avoid the approach of taking standard templates and not amending them for your specific business.
 Data Protection Policy (Article 24)
A document outlining your businesses policy on protecting personal data.
Employee Data Protection Policy (Article 24)
If you have employees, you need a document outlining your businesses policy on protecting their personal data.
Privacy Notice (Articles 12, 13, and 14)
A document setting out how you meet your business meets its obligations as regards transparency and data protection rights.
Employee Privacy Notice (Articles 12, 13 and 14)
If you have employees, you need a document setting out how you meet your business meets its obligations as regards transparency and their data protection rights.
Data Retention Policy & Schedule (Articles 5, 13, 17, and 30)
A document explaining how your business approached data retention.
Data Subject Consent Form & Withdrawal Form (Articles 6, 7, and 9)
Standard forms for data subjects to use to give and take back their consent.
Parental Consent Form & Withdrawal Form (Article 8)
Standard forms for parents of child data subjects to use to give and take back their consent.
Data Subject Access Request Form (Article 15)
Standard forms for data subjects to use to exercise their right to access data.
DPIA Register (Article 35)
A list of any Data Protection Impact Assessments carried out in your business.
Supplier Data Processing Agreement (Articles 28, 32, and 82)
The agreement you enter with your suppliers to meet your GDPR obligations.
Data Breach Response and Notification Procedure (Articles 4, 33, and 34)
Your business procedure for responding to and notifying in the case of data breaches.
Data Breach Register (Article 33)
A list of any Data Breaches that have occurred in your business.
Data Breach Notification Form to the Supervisory Authority (Article 33)
Standard forms to use if needed, to notify the Supervisory Authority of a data breach.
Data Breach Notification Form to Data Subjects (Article 34)
Standard forms to use if needed, to notify the Data Subjects of a data breach.
Inventory of Processing Activities (Article 30)
A list of your businessesâ activities where you process personal data.
Standard Contractual Clauses for the Transfer of Personal Data to Controllers (Article 46)
A standard template used if needed to transfer personal data to controllers.
Standard Contractual Clauses for the Transfer of Personal Data to Processors (Article 46)Â
A standard template used if needed to transfer personal data to processors.
Roles and Responsibilities
Public Authorities and organisations that for example regularly monitor or process large quantities of personal data, must ensure that a Data Protection Officer (DPO) is appointed either internally or externally.
Even of your business is not obliged to appoint a DPO you should still assign someone in the business as a data protection lead or ambassador. Â They will become the focal point for data protection and be responsible for moving the business towards compliance. Â Approach it like a project with milestones and goals and over time you can make quick progress.
Remember, although your business when processing personal data is obliged to adhere to the GDPR and data protection law; itâs your customers and suppliers that will also require you to show how you protect their personal data and process it in a secure and professional way.
Thank you to David Normoyle and the team at spotlightbusinessimprovement for providing all the content for the GDPR blogs.















