GDPR Compliance

The new EU General Data Protection Regulation (GDPR) makes it mandatory for organisations to notify the EU member state’s Data Protection Supervisory Authority (DPA) and, in some cases, affected data subjects in the event of a personal data breach. This specific GDPR requirement to notify makes it imperative for organisations to make sure they have effective incident reporting and investigation policies and procedures for personal data breaches that are understood and implemented by their staff. The GDPR defines a personal data breach as “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.” However, under the GDPR, notification is not required if a personal data breach is unlikely to result in a risk to the rights and freedoms of data subjects.  This means the organisation may have an opportunity to review, consider or argue the necessity of notifying a data breach, but, all this must be done within the 72 hour deadlines. In order to comply with the data breach notification obligation, organisations that process personal data of EU citizens should ensure that they have appropriate and effective corporate incident management and investigation policies with clear internal procedures and guidelines on identifying and reporting security breaches and carrying out root cause analyses. Under the GDPR, data controllers must notify the supervisory authority without delay and, where practicable, not later than 72 hours after having become aware of the incident. A personal data breach notification delay of more than 72 hours will have to be well justified. The notification to the DPA should at the minimum contain the following information: If the information above is not available immediately within 72 hours, it may be provided after the data breach notification. Data processors do not have an obligation to notify data breaches to the DPA but must notify the data controller immediately for the data controller to take the necessary actions. The GDPR offers guidance on required security standards; data controllers are obliged to ensure that their data processors have sufficient guarantees of adequate and appropriate security safeguards to protect personal data and to protect the rights of data subjects. Organisations will need to implement effective policies and procedures to comply with the GDPR data breach obligations. Staff must be made aware of the organisation’s procedures and processes and must be appropriately trained to ensure they are able to identify and report data breaches. DPOs must be able to investigate data breaches and carry out a root cause analysis for each incident to ensure lessons are learned and recurrence of incidents is avoided. For the organisation’s incident management policies and procedures to be effectively implemented, the organisation needs to develop a culture that encourages staff to report incidents.  The whole incident management processes must be treated as a learning exercise rather than an exercise to apportion blame and liability for internal discipline. The following are the key steps that organisations must make to ensure compliance with the GDPR data breach obligations;

The UK Information Commissioner’s office has published a 12 step guide to help organisations prepare for the EU General Data Protection Regulation (GDPR). The guidance outlines 12 steps that organisations need to follow to ensure their processes, systems and policies comply with the new regulation.The ICO has indicated that it will set out its plans to produce new guidance and other tools to assist organisations to prepare for the GDPR  over the next few months. The ICO will also be working closely with trade associations and bodies representing the various sectors to facilitate sector based implementation of the GDPR. Accountability is a key issue within the GDPR and organisations that process personal data must ensure that they have documented policies, procedures and processes articulating how they manage or comply with data protection requirements and legislation as an organisation. Data Controllers will no longer be required to register their processing activities with the ICO but will face strict requirements to maintain comprehensive records of their processing. Some data controllers and processors will be required to designate a Data Protection Officer (DPO) as part of their accountability programme. This is particularly where the data controller or processor’s core activities consist of processing special categories of personal data on a large scale. The GDPR still imposes the burden for data protection on data controllers. A lot of the work for organisations that wish to comply with the GDPR will go into reviewing data flows and determining lawful basis for each data flow and reviewing procedures for individuals’ rights to ensure they cover all the rights individuals have, including organisation’s procedure for deleting personal data ensuring that personal data can be provided electronically and in a commonly used format. Organisations may also need to review arrangements for sharing data with other organisations to ensure contracts are fit for purpose and meet the requirements of the GDPR. The GDPR contains more detailed requirements for the data controller-processor relationship. This means most data controllers will need to review their data processor contracts as data processors have additional duties under the GDPR and are liable for non-compliance with their contractual obligations or for acting outside the data processing authority granted by a controller. ICO checklist is a good starting point for working out areas that your organisation may need to address to comply with GDPR. The ICO checklist effectively highlights the differences between the current Data Protection Act and the GDPR making it easier for organisations to identify gaps and areas of risk. A copy of the GDPR guidance is available at: https://ico.org.uk/media/1624219/preparing-for-the-gdpr-12-steps.pdf