As the deadline for GDPR approaches, what do we need to know and what action should we be taking?
What is GDPR?
General Data Protection Regulations that come into force in the UK on 25th May 2018. Currently, the UK relies on the Data Protection Act 1998, but this will be superseded by the new legislation. It introduces tougher fines for non-compliance and breaches and gives people more say over what companies can do with their data.
Who does GDPR apply to?
‘Controllers’ and ‘processors’. The controller says how and why personal data is processed and the processor acts on the controller’s behalf. Essentially any UK business that controls or processes personal data. Controllers must ensure personal data is processed lawfully, transparently and for a specific purpose. Once that purpose is fulfilled and the data is no longer required, it should be deleted.
How do I get consent under the GDPR?
Consent must be an active, affirmative action by the data subject, rather than the passive acceptance under some current models that allow for pre-ticked boxes or opt-outs.
Controllers must keep a record of how and when an individual gave consent and that individual may withdraw their consent whenever they want. If your current model for obtaining consent doesn't meet these new rules, you will have to bring it up to scratch or stop collecting data under that model when the GDPR applies in 2018.