General Data Protection Regulations (GDPR)

European Union (EU) data protection laws came into effect from 25 May 2018, impacting businesses and changing how they must hold customer information. The General Data Protection Regulations (GDPR) applies to all UK businesses despite Brexit. Building on UK data protection legislation, GDPR is designed to strengthen data protection for individuals within the EU by handing the power back to the user and providing a ‘right to be forgotten’.

What you need to know about GDPR

To comply with GDPR you need to know what data you collect from people and make sure you can justify exactly why you collect it. You need to be able to evidence that you have obtained consent to collect, manage and store that data.

WORKING TOWARDS COMPLIANCE

Companies that do not take action risk a fine of up to four per cent of global annual turnover or 20m euros. If a data breach takes place and your agency does not inform the relevant authority within 72 hours, you will face a fine of two per cent of global annual turnover or 10m euros. In order to be compliant you need to be aware of certain key/practical points:

• Existing and prospective customers will have to provide consent in order for you to legally manage and process data for specific purposes.
• Existing or prospective customers will have to give consent for the information to be held and used.
• Companies will no longer be able to use lengthy, illegible terms and conditions full of legalese. Privacy notices must be presented in plain English and be easily accessible.
• Personal data can be any information which allows an individual to be identified including name, address or any unique identifier used by an organisation.
• Online identifiers such as IP address, cookies and tags also fall under the remit of personal data.
• In certain circumstances, individuals will have the right to request their data be removed (the right to erasure) for reasons including withdrawing consent. However, there are a number of exclusions to this, e.g. the defence of legal claims.
• It is essential that you have written contracts with any third party companies (including referencing agencies and external marketing agencies) who handle data on your behalf. These contracts need to outline the processes that are followed in handling data.
• Certain types of data breach need to be reported to the relevant data protection authority within 72 hours.