Compliance Insights Articles

This week, we’re going to take a look at contracts between data controllers and data processors, and the responsibilities and liabilities that the General Data Protection Regulation imposes. It is now just over a year since the Regulation came into force and although the past twelve months has seen the carrot approach – enabling firms to get used to the new obligations - many firms have observed a rise in informed consumers making complaints to the ICO, and therefore in inves

Time flies doesn’t it? Almost exactly one year ago, 25 May 2018, the long-awaited update to the EU’s data protection laws came into force. In this time GDPR has attracted plenty of criticism, with some accusing the EU of “overkill” or “strangling business”. Specifically, there is a loud contingent of people who view GDPR as a concoction of difficult, unworkable and protectionist requirements. How true is this? This article intends to explore this question. We’re now in a good

Following the implementation of the General Data Protection Regulation eleven weeks ago, the Information Commissioner’s Office have published a suite of guidance documents for all types of firms, helping to interpret the new rules and guide firms to apply the rules in practice. This is particularly helpful for firms experiencing some confusion about some of the more complex parts of the Regulation. The new guidance provides a helpful run-down of the process of undertaking a D

Rights requests made in relation to the General Data Protection Regulation are in the news – with increasing numbers of complaints to the regulator following the implementation of the Regulation on 25th May this year, it’s clear the general public are aware of, and are prepared to exercise, their rights. With evidence that the public are engaging with the new rules, it could be the case that some small- and medium-sized firms are under increased pressure to process requests f

In this article we’ll be taking a look at how to ensure physical records processes don’t fall foul of the General Data Protection Regulation. The headlines in the run-up to implementation made much of the Regulation’s impact on digital data, with plenty of focus on the changes the tech titans were required to make to online and digital platforms. All firms, however, should be aware of the obligations the GDPR places on business with regard to physical – paper and hard-copy –

Following up on last week’s article about timescales, we’ll look this week at the issue of logging requests that come in as part of the eight rights under GDPR. Customers, clients and users exercise most of these rights by submitting a request to the firm holding and processing their data - the right to be informed is more automatic, with the onus on the body collecting the data, and the right to restrict processing can also be triggered as part of the right to rectification.

It’s been just six weeks since the GDPR came into effect and the initial signs are that the public are aware of, and are exercising, their new rights. An article in The Guardian states that the Information Commissioner’s Office has reported an increase in both breach notifications and in data protection complaints within the first four weeks after the implementation. The GDPR provides eight rights for individuals, building on previous rights enshrined in the UK's Data Protect

Reflecting on the three weeks since the General Data Protection Regulation implementation date, it’s clear that the impact of the new legislation on the financial services sector is not limited to pre-deadline work. Firms are working hard to continue to embed business changes and evolve with the Information Commissioner’s Office’s recent guidance, new industry norms, and peer and supplier practices. At this juncture, firms should be settling in to the new regime, undertaking

So, here we are, after years of anticipation the GDPR implementation date has finally passed…and the earth is still here. Despite scaremongering and misinterpretation, businesses have not ceased to function as of 25th May 2018. However, implementing GDPR incorrectly, whether you take an overzealous approach or fail to implement key standards could have a seriously detrimental impact on your firm’s bottom line. This article is focused on those who have taken an over-zealous ap

With the 25th May implementation date for the General Data Protection Regulation looming at the end of this week, our handy guide to making good use of the final few days will help you to ensure compliance before the deadline. Regulatory change can be daunting, and both the sheer number of new rules and the much talked about consequences of getting it wrong can be intimidating. There’s no one ‘right way’ to go about preparing for the GDPR, and whether arrangements have been u

It’s never too late to take action on GDPR. As recently as March 2018, just 5% of EU companies believed they were compliant with all of the requirements. It is essential that firms work towards achieving compliance before the implementation date – now just 17 days away. The new Regulation is wide-ranging, and can seem overwhelming at first glance, especially to small and medium sized businesses trying to meet current challenges without having to factor in GDPR on top. If you

There have been plenty of articles about the risks and consequences of non-compliance, with most focusing on the maximum penalties, and a few suggesting that some firms believe that the consequences have been over-stated. Whilst we’re pleased to say we’ve not come across anyone in our sector that is not taking compliance seriously, it’s a good idea to consider the differences that the change from the Data Protection Act 1998 to the GDPR will have on sanctions. The count-down

Out with the old and in with the new. The rules relating to Data Protection are about to see the most dramatic change in years, if not ever, with the soon-to-be-implemented EU Directive 2016/679 also known as the ‘General Data Protection Regulation’ (GDPR). With drastic changes on the horizon, Data Processers are inevitably starting to feel the strain as the May 25th deadline looms in the not-so-distant future. Besides the apparent never-ending changes necessary for a firm to

One of the changes to be introduced under the General Data Protection Regulation (GDPR) is the requirement to report breaches to the Information Commissioners Office (ICO) or the data subject once certain conditions have been met, namely a personal data breach. A personal data breach is exactly what you think it would be, losing personal data. However, it is slightly wider than that, a personal data breach is defined as “a breach of security leading to the accidental or unlaw

2018 promises to be a bumper year for compliance. I can hear what you are thinking, you’ll be muttering, “Isn’t it always?” Seriously, this year promises to be more important than any since 2014 when the FCA took over regulation of consumer credit. We’ll start the year with elements of MiFid coming into force along with the Payment Services Directive. At the same time we’ll be feverishly working on becoming GDPR compliant in order to meet the May implementation date and to av

The incoming General Data Protection Regulation (GDPR) will replace the current Data Protection Act 1998 when it comes into force in May 2018. One of the first things most firms note is the requirement to appoint a Data Protection Officer (DPO). Even if firms don’t currently have a resident DPO, most are familiar with what they assume the role to be – but will this change under the new regulation? The GDPR introduces a statutory obligation for firms carrying out certain types

Your horizon scanning has never been as important as it is right now, a time when we have significant and numerous regulatory changes afoot. There is no time like the present to review the recent changes and to look ahead at what is coming up over the next seven months. A simple and easy way to stay up to date with the upcoming key changes is to sign up to our compliance insights e-alerts. We email our loyal subscribers every month with key updates (unless there is more urge

You only have around 7 months remaining until GDPR comes into force! Firms are now creating the first draft of the multitude of policies and procedures required to ensure compliance with the new standards, these include: A new data protection policy detailing your data mapping exercise, legal basis for processing data (getting this element right can save you significant resource down the line), the rights which apply to individuals based on the legal basis for processing, sec

Of all the information available on the subject of the new General Data Protection Regulation, one thing is certain; there is a lot of information to consider. Just over eight months out from the implementation of the new General Data Protection Regulation, the publication of a new blog from the Information Commissioner's Office provides helpful snapshots for firms looking to interpret how the ICO might deal with the incoming regulations. In the first blog post, the Informati

With just over nine months until the GDPR comes into effect, it is time for firms to start thinking about embarking on the next steps to compliance with the new rules. The ICO Commissioner, Elizabeth Denham, recently highlighted the importance of firms beginning preparations for the new rules, which represent “the biggest change to data protection law for a generation”. Whilst many firms will already have begun the journey towards ensuring compliance with the new rules, it is