Entry 6 of 6
Welcome to the sixth and final blog in our 6-part series on GDPR. With so much emphasis on the new regulation and the May 25th deadline drawing closer, we wanted to offer you some assistance in addressing the key questions around the new requirements. As you know, acceptcards® are experts in payments… but not so much in data protection regulations, with this in mind we have invited our friends from Legacy IT Consultants Ltd to write this guest series on our behalf. Enjoy!
The General Data Protection Regulation (GDPR) is an EU regulation that seeks to strengthen and unify data protection for all EU residents. The Accountability Principle means that organisations must be able to demonstrate compliance with the regulations, and it is explicit in stating that this is the responsibility of the organisation.
You must adopt appropriate technical and organisational measures that demonstrate and ensure compliance.
Elements could include:-
- Internal data protection policies
- Staff training
- Awareness campaigns
- Documentation and audit of all processing activities (manual and automated)
- HR policies
You should also consider:-
- Maintaining appropriate documentation on processing activities
- Documenting any ongoing control and monitoring mechanisms
- Appointing a Data Protection Officer (DPO) – in some cases this is mandatory
To support ongoing compliance, you should implement change management processes that ensure data protection by design and data protection by default.
Elements could include:-
- Data minimisation – removing data that is no longer necessary
- Pseudonymisation – separating identifiable elements
- Anonymisation – masking data so that it is no longer identifiable
- Transparency
- Process monitoring
- Additional checkpoints in the Software Development Lifecycle
- Maintaining and enhancing security features and adopting the relevant standards
- Data protection impact assessments where appropriate Organisations can also consider adherence to approved Codes of Conduct and / or certification schemes. However, it is not anticipated that these will exist in advance of the enforcement of the GDPR.
Keeping internal records of processing activity is mandatory for organisations with more than 250 employees. Smaller organisations must keep internal records of processing activity for higher risk processing where, for instance, the processing of personal data could result in a risk to the rights and freedoms of the individual, or the processing involves special categories of data.
These records include processing activities involving employee data. This is similar to the details of ‘registrable particulars’ under the Data Protection Act (DPA).
Information that must be recorded includes:-
- Name and details of your organisation
- Details of other Data Controllers, your representative, and your DPO
- Purposes of the processing
- Description of the categories of individuals and categories of personal data
- Categories or specific details of recipients of personal data
- Details of transfers to third countries
- Particulars of the transfer mechanism safeguards for third countries
- Data retention rules
- Description of technical and organisational security measures
- Details and implications of cloud services
For more information, advice or assistance on the GDPR please visit the Legacy IT website here or email them at enquiries@legacyit.co.uk
Author: Mike Madden – Legacy It Consultants Ltd.
