Compliance Insights Articles

Jun 24, 2019

Data Controllers and Data Processors Contracts and Key Liabilities Under GDPR

This week, we’re going to take a look at contracts between data controllers and data processors, and the responsibilities and liabilities that the General Data Protection Regulation imposes. It is now just over a year since the Regulation came into force and although the past twelve months has seen the carrot approach – enabling firms to get used to the new obligations - many firms have observed a rise in informed consumers making complaints to the ICO, and therefore in inves

Robert Bell

May 7, 2019

GDPR - One Year On

Time flies doesn’t it? Almost exactly one year ago, 25 May 2018, the long-awaited update to the EU’s data protection laws came into force. In this time GDPR has attracted plenty of criticism, with some accusing the EU of “overkill” or “strangling business”. Specifically, there is a loud contingent of people who view GDPR as a concoction of difficult, unworkable and protectionist requirements. How true is this? This article intends to explore this question. We’re now in a good

What is a DPIA and what must you do when you need one?

Robert Bell

Aug 7, 2018

What is a DPIA and what must you do when you need one?

Following the implementation of the General Data Protection Regulation eleven weeks ago, the Information Commissioner’s Office have published a suite of guidance documents for all types of firms, helping to interpret the new rules and guide firms to apply the rules in practice. This is particularly helpful for firms experiencing some confusion about some of the more complex parts of the Regulation. The new guidance provides a helpful run-down of the process of undertaking a D

How to deal with data subject requests under GDPR

Robert Bell

Jul 25, 2018

How to deal with data subject requests under GDPR

Rights requests made in relation to the General Data Protection Regulation are in the news – with increasing numbers of complaints to the regulator following the implementation of the Regulation on 25th May this year, it’s clear the general public are aware of, and are prepared to exercise, their rights. With evidence that the public are engaging with the new rules, it could be the case that some small- and medium-sized firms are under increased pressure to process requests f

Physical, or Hard-Copy, Data Best Practice Under GDPR

Victoria Bell

Jul 18, 2018

Physical, or Hard-Copy, Data Best Practice Under GDPR

In this article we’ll be taking a look at how to ensure physical records processes don’t fall foul of the General Data Protection Regulation. The headlines in the run-up to implementation made much of the Regulation’s impact on digital data, with plenty of focus on the changes the tech titans were required to make to online and digital platforms. All firms, however, should be aware of the obligations the GDPR places on business with regard to physical – paper and hard-copy –

Logging data subjects' requests as part of the 8 rights under GDPR

Robert Bell

Jul 11, 2018

Logging data subjects' requests as part of the 8 rights under GDPR

Following up on last week’s article about timescales, we’ll look this week at the issue of logging requests that come in as part of the eight rights under GDPR. Customers, clients and users exercise most of these rights by submitting a request to the firm holding and processing their data - the right to be informed is more automatic, with the onus on the body collecting the data, and the right to restrict processing can also be triggered as part of the right to rectification.

Time limits under GDPR in regards to the 8 rights

Victoria Bell

Jul 4, 2018

Time limits under GDPR in regards to the 8 rights

It’s been just six weeks since the GDPR came into effect and the initial signs are that the public are aware of, and are exercising, their new rights. An article in The Guardian states that the Information Commissioner’s Office has reported an increase in both breach notifications and in data protection complaints within the first four weeks after the implementation. The GDPR provides eight rights for individuals, building on previous rights enshrined in the UK's Data Protect

Legitimate Interests - A catch-all lawful basis under GDPR for processing data?

Robert Bell

Jun 7, 2018

Legitimate Interests - A catch-all lawful basis under GDPR for processing data?

Reflecting on the three weeks since the General Data Protection Regulation implementation date, it’s clear that the impact of the new legislation on the financial services sector is not limited to pre-deadline work. Firms are working hard to continue to embed business changes and evolve with the Information Commissioner’s Office’s recent guidance, new industry norms, and peer and supplier practices. At this juncture, firms should be settling in to the new regime, undertaking

Have you taken an overzealous approach to GDPR?

Robert Bell

May 29, 2018

Have you taken an overzealous approach to GDPR?

So, here we are, after years of anticipation the GDPR implementation date has finally passed…and the earth is still here. Despite scaremongering and misinterpretation, businesses have not ceased to function as of 25th May 2018. However, implementing GDPR incorrectly, whether you take an overzealous approach or fail to implement key standards could have a seriously detrimental impact on your firm’s bottom line. This article is focused on those who have taken an over-zealous ap

Victoria Bell

May 22, 2018

Pre-GDPR Audit – Check You’re Compliant

With the 25th May implementation date for the General Data Protection Regulation looming at the end of this week, our handy guide to making good use of the final few days will help you to ensure compliance before the deadline. Regulatory change can be daunting, and both the sheer number of new rules and the much talked about consequences of getting it wrong can be intimidating. There’s no one ‘right way’ to go about preparing for the GDPR, and whether arrangements have been u

It's Not Too Late to Take GDPR Action - 5 Easy Steps To Get Started

Robert Bell

May 9, 2018

It's Not Too Late to Take GDPR Action - 5 Easy Steps To Get Started

It’s never too late to take action on GDPR. As recently as March 2018, just 5% of EU companies believed they were compliant with all of the requirements. It is essential that firms work towards achieving compliance before the implementation date – now just 17 days away. The new Regulation is wide-ranging, and can seem overwhelming at first glance, especially to small and medium sized businesses trying to meet current challenges without having to factor in GDPR on top. If you

Victoria Bell

Apr 10, 2018

Risks of Non-Compliance to GDPR

There have been plenty of articles about the risks and consequences of non-compliance, with most focusing on the maximum penalties, and a few suggesting that some firms believe that the consequences have been over-stated. Whilst we’re pleased to say we’ve not come across anyone in our sector that is not taking compliance seriously, it’s a good idea to consider the differences that the change from the Data Protection Act 1998 to the GDPR will have on sanctions. The count-down

GDPR is All About Evolution, Not Revolution

Robert Bell

Apr 4, 2018

GDPR is All About Evolution, Not Revolution

Out with the old and in with the new. The rules relating to Data Protection are about to see the most dramatic change in years, if not ever, with the soon-to-be-implemented EU Directive 2016/679 also known as the ‘General Data Protection Regulation’ (GDPR). With drastic changes on the horizon, Data Processers are inevitably starting to feel the strain as the May 25th deadline looms in the not-so-distant future. Besides the apparent never-ending changes necessary for a firm to

Breach Reporting under GDPR: What You Need to Know

Robert Bell

Mar 7, 2018

Breach Reporting under GDPR: What You Need to Know

One of the changes to be introduced under the General Data Protection Regulation (GDPR) is the requirement to report breaches to the Information Commissioners Office (ICO) or the data subject once certain conditions have been met, namely a personal data breach. A personal data breach is exactly what you think it would be, losing personal data. However, it is slightly wider than that, a personal data breach is defined as “a breach of security leading to the accidental or unlaw

Robert Bell

Jan 18, 2018

Regulatory Horizon for 2018

2018 promises to be a bumper year for compliance. I can hear what you are thinking, you’ll be muttering, “Isn’t it always?” Seriously, this year promises to be more important than any since 2014 when the FCA took over regulation of consumer credit. We’ll start the year with elements of MiFid coming into force along with the Payment Services Directive. At the same time we’ll be feverishly working on becoming GDPR compliant in order to meet the May implementation date and to av

Does your firm need a Data Protection Officer (DPO)?

Robert Bell

Nov 28, 2017

Does your firm need a Data Protection Officer (DPO)?

The incoming General Data Protection Regulation (GDPR) will replace the current Data Protection Act 1998 when it comes into force in May 2018. One of the first things most firms note is the requirement to appoint a Data Protection Officer (DPO). Even if firms don’t currently have a resident DPO, most are familiar with what they assume the role to be – but will this change under the new regulation? The GDPR introduces a statutory obligation for firms carrying out certain types

Robert Bell

Nov 7, 2017

What's on the Regulatory Horizon?

Your horizon scanning has never been as important as it is right now, a time when we have significant and numerous regulatory changes afoot. There is no time like the present to review the recent changes and to look ahead at what is coming up over the next seven months. A simple and easy way to stay up to date with the upcoming key changes is to sign up to our compliance insights e-alerts. We email our loyal subscribers every month with key updates (unless there is more urge

Robert Bell

Oct 31, 2017

GDPR - The Latest Updates

You only have around 7 months remaining until GDPR comes into force! Firms are now creating the first draft of the multitude of policies and procedures required to ensure compliance with the new standards, these include: A new data protection policy detailing your data mapping exercise, legal basis for processing data (getting this element right can save you significant resource down the line), the rights which apply to individuals based on the legal basis for processing, sec

The ICO's Myth Busting Article on GDPR Explained

Victoria Bell

Sep 7, 2017

The ICO's Myth Busting Article on GDPR Explained

Of all the information available on the subject of the new General Data Protection Regulation, one thing is certain; there is a lot of information to consider. Just over eight months out from the implementation of the new General Data Protection Regulation, the publication of a new blog from the Information Commissioner's Office provides helpful snapshots for firms looking to interpret how the ICO might deal with the incoming regulations. In the first blog post, the Informati

Victoria Bell

Aug 8, 2017

Benefits (and Responsibilities) of GDPR

With just over nine months until the GDPR comes into effect, it is time for firms to start thinking about embarking on the next steps to compliance with the new rules. The ICO Commissioner, Elizabeth Denham, recently highlighted the importance of firms beginning preparations for the new rules, which represent “the biggest change to data protection law for a generation”. Whilst many firms will already have begun the journey towards ensuring compliance with the new rules, it is