Build awareness about the change and what GDPR will mean for your organisation, especially the tougher penalties.
Make an inventory of the personal data you hold and how it is managed. Consider:
– Why are you holding it?
– How did you obtain it?
– Why was it originally gathered?
– How long will you retain it?
– How secure is it, both in terms of encryption and accessibility?
– Do you ever share it with third parties and on what basis might you do so?
Create a plan for any changes that you need to make in your current process. Under GDPR individuals will be able to request an audit of the information you hold on them, so you will need a clear plan in place to deal with such requests and other GDPR requirements. Your plan needs to include:
Who will be responsible for handling GDPR requests? Remember requests must be processed within one month, and must be free of charge to the individual making the request. Individuals have the right to access their data, have inaccuracies corrected, have their information erased and object to direct marketing.
What are your procedures for detecting, reporting and investigating a data breech? Who will be responsible? Remember that all breaches must be reported to the DPC or UK equivalent, typically within 72 hours, unless the data was anonymised or encrypted.
How is customer consent currently being managed? How do you currently seek, obtain and record consent? What changes do you need to make to this process? Remember under GDPR consent must be freely given, specific, informed and unambiguous. That means they must be completely aware that they are consenting to the processing of their personal data, and know exactly what they are consenting to – there can be no doubt. Silence, pre-ticked boxes or inactivity is not consent.
What information do you give individuals prior to processing data? Remember before gathering data, you need to let people know: the legal basis for processing the data, how long you will retain their data, and their right to complaint. And you must communicate all of this in easy to understand language not legalese.
