Many people have contacted us about the ‘General Data Protection Regulation’ and its implementation.
What is GDPR?
The GDPR is an EU Regulation which is being brought into effect across Europe by May 2018. By the very nature of being a ‘regulation’ it will REPLACE the existing legislation.
But what about the UK and ‘Brexit’?
The UK Government announced in October 2016 that the GDPR would come into force in the UK on 25th May 2018, regardless of our EU status. The Information Commissioner’s Office (ICO – the UK regulatory authority on data protection) has been leading the way in pushing for reform of the existing legislation for along time and the UK Government has taken this into account and stated that reform will be re-researched once we have left the EU.
Why is the UK Implementing the GDPR?
Because both the UK and Europe will continue to trade. Information (particularly digital) is a huge part of business and having this ‘guidance’ legally in place across the board will help.
I am being encouraged to prepare for this – What do i do?
The ICO are publishing guidance on their website over a period of time in the lead-up to May 2018. To this end they have published a ’12 Steps’ document that outlines the major changes, but we still await all the detail on what is expected.
Good news! The 12 Steps document starts by saying:
“….If you are complying properly with the current law then most of your approach to compliance will remain valid under the GDPR….”
For example, the GDPR talks of a certification scheme – this may well take the form of the current Notification Scheme that the ICO has in place.
The first step is AWARENESS – Congratulations! you can tick that box, as you are reading this post!
However… there will be new elements and significant enhancements – there are new accountability rules which require new Documentation, and Privacy Notices will need to be amended.
Some aspects of data protection under the 1998 Act have been considered ‘best practise’ or ‘implicit’ but under the GDPR these become ‘legal requirement’.
Therefore, this is a starting point for businesses. There can be no generic approach for businesses and therefore a training course is difficult to devise. Each organisation across the UK will need to assess its own policies and procedures to ensure that are ‘fit for purpose’ to meet the new rules.
- Robyn Banks – Data Protection Consultant
