![\"\"](\"https:\/\/tiger-recruitment.com\/wp-content\/uploads\/2018\/03\/GDPR-2.jpg\")
\nData Protection Officers and Breaches<\/h3>\n
The General Data Protection Regulation (GDPR) has revolutionised the collection and storage of personal data in the EU since it’s introduction in May 2018. When it was introduced, it had major repercussions for many small and medium enterprises.<\/p>\n
The regulation\u2019s main aim is to give individuals control of their data once more; giving them the right to know how any company is handling personal data. For the purposes of the legislation, personal data is classified as information held about a living individual, which can identify who they are.<\/p>\n
The regulation can be broken up into seven key principles:<\/p>\n
\u2022 The right to be informed
\n\u2022 The right of access
\n\u2022 The right of rectification
\n\u2022 The right to erasure
\n\u2022 The right to restrict processing
\n\u2022 The right to data portability
\n\u2022 The right to object<\/p>\n
These principles apply to three main areas: consent, data privacy, and data protection officers. Failure to comply can result in fines of up to \u20ac20 million or up to four per cent of total global revenue of the preceding year, whichever is greater.<\/p>\n
Since the introduction of GDPR, businesses have had to ensure that consent is freely given with an affirmative and clear action. Instead of asking consumers to tick the box if they don\u2019t want to hear from a company, SMEs must now ask consumers to tick the box if they do want to receive marketing material.<\/p>\n
On the other side of the coin, withdrawal of consent is now required to be as simple as possible. Consumers must be informed that they have the right to withdraw consent at the time of signing up, and businesses must make this process as easy as possible. Furthermore, when withdrawn, an individual\u2019s details must be permanently erased, not just removed from the relevant databases. Essentially, individuals now have the right to be forgotten, so data records must be as up to date as possible, with inaccurate entries corrected without delay.<\/p>\n
In collecting and storing data, companies must also provide a clear trail of consent in case of audit, with screen grabs or saved consent forms.<\/p>\n
One of the most striking changes found in the GDPR in comparison to older laws is the requirement of businesses to prove they have a legal basis to store and use any gathered data, and provide details of where their data is stored. Reasons for processing data must be specific, explicit and have a legitimate purpose.<\/p>\n
The regulation recognises four lawful bases for processing:<\/p>\n
1. Explicit consent \u2013 individual must proactively supply consent through a positive opt-in
\n2. Compliance with a legal obligation \u2013 for example, to process right to work checks
\n3. Entering into a contract with an individual to supply goods and services or fulfil an obligation \u2013 for example, an employment contract
\n4. Legitimate interests, unless outweighed by the individual\u2019s rights and interests. Businesses must prove they have genuine reasons to process personal data without consent by satisfying the following criteria:
\na. Organisations must need to process information for its own legitimate interests or for those of a third party to whom it may disclose the data.
\nb. The legitimate interests must be balanced against the individual\u2019s \u2013 processing must not prejudice the rights and freedoms, or legitimate interests, of the individual. If in conflict, the individual\u2019s interests will take priority.
\nc. Any processing must be fair, transparent, accountable and must comply with all the data protection principles.<\/p>\n
Companies can now only hold data that is necessary for the purpose of processing, keeping retention periods to a minimum. SMEs must also know exactly where their data is located.<\/p>\n
One of the most effective ways to ensure full compliance to the GDPR is to hire a data protection officer (DPO). In fact, the regulation states that a DPO must be appointed for all public authorities or any businesses whose core activities involve the systematic monitoring of large amounts of personal data.<\/p>\n
A DPO is responsible for implementing any data protection strategies and is accountable for maintaining all documentation that proves full compliance with the GDPR. The regulation doesn\u2019t specify any necessary credentials, but suggests that anyone employed as a DPO have expert knowledge of data protection law and practices. They can be employed on a permanent basis or under a service contract, and can be shared by a group of businesses, proving equal accessibility. A DPO should report to the highest management level and be located in the EU.<\/p>\n
In the event of a data breach, companies must inform the relevant authorities within 72 hours, providing extensive details of the problem and proposing mitigation strategies.<\/p>\n
Tiger Recruitment can help source temps with a data background to cleanse and tidy databases and delete records, or contracted data protection officers to help companies remain GDPR compliant.<\/p>\n