Data Management

The UK’s implementation of the GDPR

25 May 2018

A complete data protection system so as well as governing personal data covered by the GDPR, it covers all general data as previously covered by the 1998 Act

It relates to personal data

• Aims to create a single data protection regime for anyone doing business in the EU and to empower individual to take control of how their data is used by third parties
• Provides a right to know how a person’s data is used

An obligation to conduct data protection impact assessments for high risk holding of data

New rights for individuals to have access to info on what personal data is held and to have it erased

Data Accountability – ensuring organisations can prove to the Information Commissioners Office how they comply with the regulations

Data breaches to be reported within 72 hours

An increase in fines up to 4% of company’s global turnover or 20m euros (whichever is great)

A data processor decides how and why personal data is processed and is directly responsible for GDPR

• Data must be:
• Processed lawfully, fairly and collect in a transparent manner
• Collected for legitimate purposed
• Relevant for the reason in which it is processed

The controller shall be responsible for and be able to demonstrate compliance with principles

• Right to be informed
• Right of access
• Right to rectification
• Right to erasure
• Right to restrict processing
• Right to data portability (to use for their own purposes)
• Right to object
• Right to automated decision making and profiling

• Gives individuals the right of access to information held by public bodies
• Public bodies usually required to provide info within 20 working days
• It can charge to provide info

• If contrary to GDPR
• It would prejudice a criminal investigation or person/organisation’s commercial interest

Using firewalls, encryption, and passwords

Non-disclosure agreement