Less than two months to prepare for GDPR!

By Lancashire Business View

09 Apr 2018

By Daniel Milnes, partner, head of commercial, and Daniel Crayford, trainee solicitor, Forbes

There is still time to prepare for GDPR – provided that you do it right!

Start by taking a look at our GDPR webpages and the ICO’s guidance. The ICO has published a useful template to use in your data mapping exercise – which is the first job on the list for your preparations.

You will need to go through all of your records, trawl through the old files hidden in the basement, check all the post-it notes down the back of cabinets and sift through IT systems, mailing lists, local files and cloud storage directories.

The goal is to establish exactly what personal data you hold (remembering that personal data can be anything that identifies a living individual – not just names, addresses and photographs).

Once you have worked out what personal data you are processing, the next stage is to note the purposes for that processing, and the lawful ground or grounds on which you are processing it – be that to fulfil a legal obligation, as part of the performance of a contract, consent etcetera.

Once you have finished your data map, you see where the gaps are in your compliance plan – does your retention policy deal with all of the types of personal data that you hold? Does it provide for periodic reviews and file-thinning? Do you have privacy notices for each category of data subject (employees, customers, board members etcetera)? Is all of the personal data you process stored securely? Does your business insurance include cyber insurance?