The General Data Protection Regulation – An introduction to GDPR

Posted on by OPS

The General Data Protection Regulation is upon us and will completely change the way all businesses use personal data. To ensure you’re working towards compliance we’ve put together a series of blog posts which provide a useful overview of the key aspects.

Read our GDPR blog series:

  1. How the GDPR affects the personal data you hold
  2. Plan how you need to change ahead of GDPR implementation
  3. How GDPR gives rights to individuals and their data
  4. What is your lawful basis for processing data
  5. GDPR gives you a duty prevent and report data breaches

GDPR brings a new level of data protection

On 25th May 2018 The General Data Protection Regulation (GDPR) comes into force. GDPR is a new regulation designed to bring current data protection laws into the 21st century. In the modern world it’s become common place for people to regularly give permission for their personal information to be gathered, stored and used for a variety of reasons.

A key drive for GDPR is in relation to the many online services who provide free tools or apps in exchange for being able to gather their user’s personal data.  The dangers of individuals granting permission on a vast scale are obvious.

In the UK GDPR will replace the Data Protection Act 1998 and will give people control of how any organisation uses their data. It will also introduce fines for businesses who fail to comply with GDPR rules and ensure data protection laws are the same across the EU.

Even though GDPR is officially an EU law, it will be implemented in a post Brexit UK. The government has already introduced a new Data Protection Bill (governed by the ICO) which aims to carry over much of the GDPR law after Brexit. In short, the fact the UK is leaving the EU does not mean businesses can ignore it. You’ll also be wrong in thinking that GDPR only affects big businesses, if you store any kind of personal data you need to take steps to comply.

A business that is complying with current data protection laws will see many of their processes remain valid, however there will be changes and enhancements to make.

What will GDPR compliance look like?

Many businesses gather personal information for a host of reasons, including from customers, prospects, members or service users. Previously the way this information has been gathered, stored and used has come under little scrutiny, but not for much longer. The GDPR brings about legislative change that asserts that data belongs not to business, but to the individual. The new regulation aims to give people greater control over the collection and use of their personal data.

Under the rules of GDPR organisations will have to prove that personal data was gathered legally and have taken steps to ensure it is not misused. Individuals will have the right to ask you where you got it from and instruct you to delete it should they wish. Staff may also need to be trained to ensure they handle data appropriately and document how they’ve done so.

There isn’t a one approach fits all model, it’s down to businesses to take responsibility and determine what needs to happen to achieve compliance.

What steps are Flex4 taking to prepare for GDPR?

In preparation for the introduction of GDPR, Flex4 have undertaken the following:

  1. Carried out a data mapping exercise to understand what personal data is stored and accessed within our business.
  2. We have updated our terms of use and privacy policy to comply with GDPR requirements, which will apply to you on and after May 25, 2018.
  3. We have created  a Data Processing Agreement for all of our OPS customers (see below).
  4. We have received Data Processing agreements from our own data processors.
  5. We have installed the Wordfence security suite on all OPS websites.
  6. We have implemented an SSL certificate on our own websites.
  7. We have developed new OPS functionality to allow customers to agree to terms and conditions and / or privacy policy when a user next logs in or registers as a new user. The new functionality also includes the ability for users to confirm their marketing preferences (i.e. email, telephone and post).

These are just some of the many steps Flex4 has taken to meet the data transparency goals of the GDPR. This continues our practice of protecting your data and providing for the legal and secure handling of your organisation’s critical business information.