)
The General Data Protection Regulation (GDPR) took effect on 25th May 2018. This regulation intended to strengthen and unify data protection for all individuals within the EU. All organisations who hold data were required to adhere to strict procedures and meet standards relating to the information they held.
Complying with the GDPR rules is not only mandatory but it also gains the trust of the workforce and customers.
So, how do you make sure your data collection practices don’t break the law?
Be Prepared
For some, just hearing the acronym GDPR can send their pulse raising and give them butterflies. But the more research and preparation an organisation can do to understand its impacts the better. Ensuring your databases are in order should be a priority to reduce the risk of breaches.
Appoint a Data Protection Officer
It’s good practice to appoint a Data Protection Officer (DPO) within your organisation even if your company does not fall into the category deeming this role a necessity. This key player can dedicate time to understand the changes coming into force and oversee your strategies and compliance programmes. It is important that your DPO delivers training to keep the rest of your workforce informed of what is expected of them.
Create an Accurate Inventory
It’s advisable to build and maintain a detailed database of all the personal data you hold. It is also critical you know the answers to these questions about the information you hold:
Why are you holding it?
How did you acquire it?
How long do you need to hold it?
Do you share it with third parties, if so, why?
Where is the data held and how secure is it? Consider the need for encryption and accessibility.
Clear policies and procedures on handling, storing and processing this data must be put in place to ensure your company remains compliant.
Understand Transparent Privacy Rights
The GDPR respects the rights of individuals, these include the right to rectify or erase inaccurate or incomplete data and the right to request a copy of the information held on them.
Following a request your organisation must action within 30 days. Even more reason to keep an up to date and accurate database.
Review Key Documents
The key documents that employers should review as part of the GDPR compliance include: data protection policy, policies that involve the processing of HR-related personal data, policies on “bring your own device”, recruitment, equal opportunities.
Review Privacy Notices
Your organisation will need to review its privacy notices and clauses to reflect any changes you need to make. Customers have a right to understand how the information you hold on them will be used.
Gain Explicit Consent
Consent must be explicitly sought by organisations wanting to legitimate the use of sensitive data. The consent given must be obtained in a way that leaves no room for misinterpretation and must be as easy to withdraw as to give.
Research Child Consent Policies
The GDPR has rules for the consent requirements and rights of children. The default age at which someone is no longer considered a child is 16, but the Regulation allows member states to adjust that limit to anywhere between 13 and 16.
Implement a Privacy-By-Design Approach
Under the GDPR, Data Protection Impact Assessments (DPIA) will become a requirement prior to undertaking new projects. Following this rule, businesses will be able to see how changes can affect individual’s privacy.
Data Breaches
The data breach notification requirement is one of the biggest challenges that the GDPR presents to businesses. A detailed account of the breach must be reported within 72 hours of discovery to your Supervisory Authority (SA). It is crucial that a policy and procedure has been put in place to include who your SA is.
All breaches should be recorded together with the steps put in place to prevent similar incidents happening again.
Review Contracts with any External Suppliers
If you use third parties to process personal data on your behalf (i.e. Payroll, HR), all contracts with such third parties should be reviewed for compliance with data processing requirements in advance of 25 May 2018, and amendments negotiated if they are not compliant.
Don’t Panic
Our final piece of advice! There is a lot to be done to ensure your company is compliant but if you keep a clear, accurate and detailed database you’ll be in great shape.
Our simple to use automated HR data management system not only eases the flow of data and documents, generates reports and sets permissions; it eliminates the butterflies in your stomach too!
How we can help you
If you’d like to discuss any of the issues detailed in this blog, get in touch with us today. We’re here to help.
)