For this week’s blog, I have invited Legal Executive, Charlotte Alexander from our corporate and commercial team, to write a Q&A article on the new General Data Protection Regulation (GDPR) which comes into force next year. Charlotte and Louise White, solicitor in the same team, recently ran some seminars to make our clients and contacts aware of the GDPR changes and what we should all be doing to prepare. Details of future events will be published on our website, in the events page and on social media in due course.
When will the new Regulation apply?
What can organisations expect?
Organisations must devote time and effort, and prepare appropriate resources to implement the changes under the GDPR.
Which concepts are going to impact organisations the most?
Accountability and Data Processors – data processors will have direct compliance obligations and shall be subject to penalties for the first time under the GDPR.
Validly obtaining Consent – this will be harder to obtain due to the very high standard of consent required by the GDPR. Organisations will need to be able to demonstrate consent was validly obtained.
Privacy Impact Assessments – organisations will need to perform data protection impact assessments (PIAs) before carrying out any processing that uses new technologies.
Enhanced rights of Data Subjects – organisations will need to respect the enhanced rights of data subjects and act accordingly.
Increased Enforcement Powers – fines under the GDPR will significantly increase.
What will organisations need to do?
Appoint a person or team to take responsibility for compliance with the GDPR.
Identify what data is held by the organisation and why? On what legal basis is the organisation processing the data i.e. consent, contractual, legitimate interests? Where is the data stored and who has access to it?
Review the organisation’s procedures, policies and privacy notices. All commercial agreements should be reviewed to ensure the new obligations and potential risks are covered.
Organisations should maintain detailed documentation in order to show paper trails relating to data processing activity and privacy impact assessments carried out.
How will Brexit affect Data Protection?
Can Jacksons help?
For more information please contact Charlotte Alexander at calexander@jacksons-law.com or telephone 01642 356 504.
