The GDPR countdown begins: why now is the time to start preparing
You’d be forgiven for thinking that the introduction of GDPR is in the distant future. With so much else going on in the world, it’s unlikely that data regulations will be at the forefront of everyone’s minds.
But for businesses, they should be.
As far away as they might seem, the reality is that the regulations are looming – this Thursday marks a year until they arrive in full force, so now is the time to be preparing your business for the changes.
If you’re wondering where on earth to begin, we’ve put together an overview of what you need to know:
- What?
The General Data Protection Regulations have been devised to bring existing legislation up to date. The new rules will govern how businesses obtain, process and hold personal information, as well as requiring proof that adequate measures are taken to protect this data from being lost or accessed without permission.
- When?
The new regulations will be implemented on the 25th May 2018 – this is in line with the maximum 2-year transition period, as the decision to switch from existing EU legislation was made in May 2016.
- Where?
As an EU-wide directive, businesses operating in all member states will be affected. But it’s crucial to note that any company that processes the data of EU citizens will also be required to adhere to the new rules, even if they don’t have a physical presence within the union.
- Who?
Every business will need to ensure that their data protection practices are in line with the new legislation. And it’s vital that SMEs don’t think they’re exempt because of their size – the penalties for any infringements or data breaches will be calculated from exactly the same framework as a global corporation.
- Why?
Protecting sensitive information and the rights of the individual is at the core of the new regulations. The rules are there to make sure that businesses are processing data in a way that is legal, fair and transparent for legitimate purposes. They also ensure that the information has been obtained with consent, isn’t being held for longer than necessary and remains accurate over time.
- How?
While preparing for GDPR is vital for all businesses, many aren’t sure how to go about it. Conducting an audit of all the personal data you currently process – and reviewing the legitimacy you have for doing so – is a good place to start. If you begin the documentation process now, then it won’t seem like a huge workload increase once the regulations are enforced. It’ll also help you to spot any gaps in your existing procedures, and to understand how clear you need to be about your use of personal data.Now is also a good time to be thinking about who in your team will be best suited to taking on the role of Data Protection Officer. Assigning this position will be mandatory for most businesses – however, it can’t be given to anyone who already has IT or development responsibilities, which might make it tricky for certain specialist firms, or companies with a small workforce. Fortunately, rather than having to take on a full-time person to fill the role, you can enlist the help of a qualified independent officer to manage the data protection practices of your business – did you know we can tick this all-important box?
There’s undeniably a lot to think about, which is why there’s no time to prepare like the present! And luckily, we understand how overwhelming the impending changes can seem, so we’re on hand to help.
To find out more about how we can help your business with the transition, read about the GDPR services we offer. Or, to arrange a no obligation consultation, just get in touch!
