Business Legal Advice on Data Protection & GDPR Compliance

Personal information should be kept for no longer than it is needed. Organisations will need to be able to justify why (and how) they hold persona data and for how long. Ideally organisations will implement a Data Retention Policy which set out standard retention period where possible. If data can be anonymised, it might be acceptable to keep that data for longer than usually appropriate but organisations should have carried out a data privacy impact assessment (a risk assessment) to assist them reaching the decision to retain data for the relevant period and to document how the organisation reached that decision.

The purpose of the GDPR is to provide a set of standardised data protection laws across all the EU member countries.

GDPR is trying to achieve protection for individuals’ personal information. It is also trying to achieve minimum standards of protection for that information across the European Union.

This should make it easier for EU citizens to understand how their data is being used, and also raise any complaints, even if they are not in the country where its located.

The GDPR is an EU wide piece of legislation that (once passed by the EU institutions) directly applies and is enforceable at national level. This means that the nation state (for example the UK) doesn’t need to introduce national legislation to bring the GDPR into force. This means that the rights protecting individuals which are set out in the GDPR (for example on subject access).

However the UK (and other member states) have passed supplementary national legislation (such as the Data Protection Act 2018) to deal with national issues such as additional powers for the state or the regulator (ICO in the UK) as well setting out the powers and responsibilities of the national regulator (such as the power to levy registration fees). So the GDPR and the DPA2019 effectively sit along side each other.

GDPR is a regulation that requires businesses to protect the personal data and privacy of EU citizens for transactions that occur within EU member states.

The GDPR requires organisations who process personal information (known as “personal data”) relating to others to keep that data safe, and to only process the data if they have lawful grounds to do so.

Companies that collect data on citizens in European Union (EU) countries need to comply with strict rules around protecting customer data. The General Data Protection Regulation (GDPR) sets a new standard for consumer rights regarding their data, but companies will be challenged as they put systems and processes in place to maintain compliance.

In summary, the GDPR obliges organisation who processes personal data to protect that personal data and only process it if they have lawful grounds to do so (including being transparent about what data is held and why and what is done with it, only processing the data for the purpose for which is was collected, only processing – collecting- the minimal amount of data needed for the lawful processing and making sure that the organisation has appropriate technical and organisational measures in place to protect.

The GDPR applies to all organisations (which includes sole traders, charities, partnerships and limited companies) who have a branch in an EU member state or if the organisation is based outside the EU, then if that organisation either “processes” personal data in the European Union or if customer, employees, users etc are based in the EU. “Processing” includes if the data is in transit, stored, or otherwise.

• Information
• Access
• Rectification
• Erasure (‘Right to be Forgotten’)
• Restriction of processing
• Portability (in a format to enable transfer)
• Object to processing
• Automated decision making, including profiling.

• there must be a lawful basis to process personal data and 
• that, among other things, organisations must be open with individuals about the data held by them and what processing is carried out.

• an organization should only collect personal data for specified, explicit, and legitimate purposes; and
• should not process the personal data in a manner that is incompatible with those purposes, except under limited circumstances.

• adequate;
• relevant; and
• limited to what is necessary for the purpose of processing.

• accurate and kept up-to-date; and
• corrected or deleted without delay when inaccurate.

• Comply with the six principles when processing personal data (Article 5(1), GDPR); and
• Demonstrate that compliance with all six of the principles (Article 5(2), GDPR).

• establishing and maintaining a comprehensive data protection compliance program;
• appointing individuals responsible for overall data protection matters (for example a Data Protection Officer:
• Rolling out policies and operations;
• Providing staff training on GDPR;
• Implementing appropriate technical and organizational measures (“TOMS”), for example carrying out Privacy Impact Assessments;
• determining and documenting a lawful basis for each instance of processing personal data (including satisfying any additional requirements if processing Sensitive or Special Personal Data)
• keeping records of data processing activities;
• being transparent with Data Subjects by providing them with information about the processing that is taking place with their Personal Data (including Privacy Notices);
• making sure that the rights of individuals are protected, for example following out Subject Access Requests in the timescales set;
• making sure that arrangements with joint controllers, data processors and international transfers of data comply with the minimum standards set out in the GDPR.