GDPR: countdown to compliance for the family business

In May 2018 a new law will be imposed called the General Data Protection Regulation (GDPR). It brings about the biggest change to data protection laws in over 20 years. Family owned businesses, which form an enormous proportion of the UK’s economy, will have to take notice of this, and be prepared.

There has been a lot of coverage – not least due to the headline-grabbing threat of up to €20m fines, but many remain unsure of what they should actually be doing to get ready.

There are some key basic steps to go through to assist you to understand what will be required in practical terms.

1. Audit your data – you will need to know what data you hold, where it comes from, what you do with it, where you keep it, who you share it with and what happens to it when it is no longer needed. 
2. Fair processing notices – whether you refer to them as FPNs, privacy policies, data protection statements or something else entirely, the information that you give to individuals when you collect their data will need to be updated to meet the new information standards in the GDPR.
3. Consent mechanisms – under the GDPR you must meet a higher standard of consent and record how and when consent was obtained, all of which will require some updating to your current systems.
4. Streamline your SAR process – the GDPR reduces the time for providing a response to a Subject Access Request from 40 days to one month (and abolishes the £10 fee). Individuals have new rights under the GDPR, specifically the right to be forgotten and the right to data portability. You will need to ensure you understand what these rights involve and how you will comply with them.
5. Record your processing – from May 2018 you will no longer have to register with the Information Commissioner’s Office (ICO) but you must keep a written record of your processing activities, security measures and data retention practices instead.
6. Appoint a Data Protection Officer – for many organisations this will be a mandatory requirement under the GDPR.
7. Update your breach procedures – from May 2018 mandatory breach reporting will begin – most breaches must be notified to the ICO within 72 hours and you must keep a full internal breach register.
8. Train your staff – staff awareness is absolutely crucial to compliance. Different staff members will require different training depending upon their role and responsibilities but all staff will require some basic awareness training around the GDPR at the very least.

We can provide full details of the changes introduced by the GDPR. We also offer a range of training courses to help your business comply with data protection laws and to raise awareness amongst your staff.

The content of this article is for general information only. Law covered as at July 2017.

This article is from the July issue of The Family Business, our newsletter for those working within family-owned businesses. To download the latest issue, please visit the newsletter section of our website.