GDPR digest - tmaclub.com · ARE YOU GDPR READY? {More than a MORTGAGE CLUB} GDPR digest
The Gdpr – 5 steps to compliance · THE GDPR – 5 STEPS TO COMPLIANCE Maureen Daly, Partner 3 0...
Transcript of The Gdpr – 5 steps to compliance · THE GDPR – 5 STEPS TO COMPLIANCE Maureen Daly, Partner 3 0...
D A T E :
T H E G D P R – 5 S T E P S TO C O M P L I A N C E
Maureen Daly, Partner
3 0 / 1 1 / 1 7
0 0 / 0 0 / 0 0 DOCUMENT TITLE P A G E 1
BUSINESS LAW UPDATE 2017 P A G E 2
Regulation (EU) 2016/679 of the European
Parliament and of the Council of 27 April 2016
on the protection of natural persons with
regard to the processing of personal data and on the free movement of
such data, and repealing Directive 95/46/EC
General Data Protection Regulation
THE GDPR
WHAT ’S IN A NAME?
3 0 / 1 1 / 1 7
BUSINESS LAW UPDATE 2017 P A G E 3
Overhauls data protection law in Europe
Applies a single set of rules across Europe
Comes into effect on 25 May 2018
WHY IS THE GDPR SO IMPORTANT?
3 0 / 1 1 / 1 7
BUSINESS LAW UPDATE 2017 P A G E 4
1. APPOINTMENT OF A DATA PROTECTION OFFICER IN CERTAIN CIRCUMSTANCES
2. BUSINESSES MUST BE CLEARER ABOUT HOW THEY USE PERSONAL DATA
3. ENHANCING REQUIREMENTS FOR VALID CONSENT
4. ENHANCED RIGHTS FOR INDIVIDUALS SUCH AS THE DATA PORTABILITY RIGHT
5. TIME PERIOD FOR DEALING WITH ACCESS REQUESTS REDUCED
6. MANDATORY DATA PROTECTION IMPACT ASSESSMENTS IN CERTAIN CASES
7. DATA BREACHES MUST BE NOTIFIED WITHIN 72 HOURS
8. NEW OBLIGATIONS FOR PROCESSORS
9. INCREASED PENALTIES FOR NON-COMPLIANCE
10. ABILITY TO APPOINT A LEAD SUPERVISORY AUTHORITY
NEW OBLIGATIONS
3 0 / 1 1 / 1 7
BUSINESS LAW UPDATE 2017 P A G E 5
Document what personal data you hold, where it came from, why was it
originally gathered, how long will you retain it, how
secure is it and who you share it with
Identify (and document) the lawful basis for your
processing personal data
Prepare action plan – allocate budget and
resources
ST E P # 1 : C A R RY O UT A DATA AUD I T
3 0 / 1 1 / 1 7
BUSINESS LAW UPDATE 2017 P A G E 6
STEP #2: REVIEW POLICIES AND PRIVACY NOTICES
They must include the additional
information set out in the GDPR as
well as the new rights granted to
individuals
The information must be concise,
easy to understand and be in clear language
Review and make necessary changes
3 0 / 1 1 / 1 7
BUSINESS LAW UPDATE 2017 P A G E 7
Procedures should cover all the rights
individuals have
Plan how to deal with access requests and data deletion requests
Review and make necessary changes
Consider whether you need to appoint a DPO
STEP #3: REVIEW PROCEDURES
3 0 / 1 1 / 1 7
BUSINESS LAW UPDATE 2017 P A G E 8
Review how you seek, record and manage consent
Ensure “consent” is specific, clear, freely given and unambiguous
Positive action required Right to withdraw consent at any time and must be easy to withdraw as to give consent
CONSENT
3 0 / 1 1 / 1 7
BUSINESS LAW UPDATE 2017 P A G E 9
STEP #4: PREPARE AN INCIDENT REPORT PLAN
Implement, test and needs to be live by 25 May 2018
Have a clear plan of action
Review procedures to ensure you can detect, report and investigate personal data breaches
3 0 / 1 1 / 1 7
BUSINESS LAW UPDATE 2017 P A G E 1 0
SUPPLIERS
• Review contractual arrangements as it may be necessary to make amendments to comply with the GDPR
TRAINING
• Your employees should be made fully aware of the implications of changes and should be trained in the application of any new policies
INTERNATIONAL
• If your business operates in more than one EU Member State, map out where your business makes its most significant decisions about its data processing activities to determine your ‘main establishment’ and so, your lead supervisory authority - document this!
STEP #5: SUPPLIERS , TRAINING & CROSS -BORDER
3 0 / 1 1 / 1 7
0 0 / 0 0 / 0 0 DOCUMENT TITLE P A G E 1 1
1. NEEDS A CONCLUDING PHOTO /MESSAGE