Follow Us

Compliance Insights Articles

Search

FCA's Priority of Operational Resilience - What Does That Mean For Your Firm?

Dec 11, 2019

FCA's Priority of Operational Resilience - What Does That Mean For Your Firm?

High on the FCA’s cross-sector priorities for 2019/20 is ‘operational resilience’. The Regulator has recently turned its attention to technological changes and advances, particularly where these might impact on consumers or on regulator supervision, so it’s no surprise that high on the agenda is potential disruption caused by failure – or something more nefarious – of IT systems and other technologies. Acknowledging that apart from the increasing use of new technologies in fi

What is explicit consent?

Nov 27, 2019

What is explicit consent?

With vulnerability high on the FCA’s agenda for 2020, financial services firms have an eye on its new guidance document, which seeks to clarify what the regulator expects to see in terms of culture, product design, staff training, and support options. The FCA’s response and final guidance is due in the first half of 2020, but the guidance document as it stands provides a clear impression of where firms should be heading in their treatment of vulnerable customers in 2020. But

What is a DPIA and what must you do when you need one?

Aug 7, 2018

What is a DPIA and what must you do when you need one?

Following the implementation of the General Data Protection Regulation eleven weeks ago, the Information Commissioner’s Office have published a suite of guidance documents for all types of firms, helping to interpret the new rules and guide firms to apply the rules in practice. This is particularly helpful for firms experiencing some confusion about some of the more complex parts of the Regulation. The new guidance provides a helpful run-down of the process of undertaking a D

Physical, or Hard-Copy, Data Best Practice Under GDPR

Jul 18, 2018

Physical, or Hard-Copy, Data Best Practice Under GDPR

In this article we’ll be taking a look at how to ensure physical records processes don’t fall foul of the General Data Protection Regulation. The headlines in the run-up to implementation made much of the Regulation’s impact on digital data, with plenty of focus on the changes the tech titans were required to make to online and digital platforms. All firms, however, should be aware of the obligations the GDPR places on business with regard to physical – paper and hard-copy –

Time limits under GDPR in regards to the 8 rights

Jul 4, 2018

Time limits under GDPR in regards to the 8 rights

It’s been just six weeks since the GDPR came into effect and the initial signs are that the public are aware of, and are exercising, their new rights. An article in The Guardian states that the Information Commissioner’s Office has reported an increase in both breach notifications and in data protection complaints within the first four weeks after the implementation. The GDPR provides eight rights for individuals, building on previous rights enshrined in the UK's Data Protect

Pre-GDPR Audit – Check You’re Compliant

May 22, 2018

Pre-GDPR Audit – Check You’re Compliant

With the 25th May implementation date for the General Data Protection Regulation looming at the end of this week, our handy guide to making good use of the final few days will help you to ensure compliance before the deadline. Regulatory change can be daunting, and both the sheer number of new rules and the much talked about consequences of getting it wrong can be intimidating. There’s no one ‘right way’ to go about preparing for the GDPR, and whether arrangements have been u

Risks of Non-Compliance to GDPR

Apr 10, 2018

Risks of Non-Compliance to GDPR

There have been plenty of articles about the risks and consequences of non-compliance, with most focusing on the maximum penalties, and a few suggesting that some firms believe that the consequences have been over-stated. Whilst we’re pleased to say we’ve not come across anyone in our sector that is not taking compliance seriously, it’s a good idea to consider the differences that the change from the Data Protection Act 1998 to the GDPR will have on sanctions. The count-down

GDPR is All About Evolution, Not Revolution

Apr 4, 2018

GDPR is All About Evolution, Not Revolution

Out with the old and in with the new. The rules relating to Data Protection are about to see the most dramatic change in years, if not ever, with the soon-to-be-implemented EU Directive 2016/679 also known as the ‘General Data Protection Regulation’ (GDPR). With drastic changes on the horizon, Data Processers are inevitably starting to feel the strain as the May 25th deadline looms in the not-so-distant future. Besides the apparent never-ending changes necessary for a firm to

Personal Data Breach: What do you need to consider under GDPR?

Mar 21, 2018

Personal Data Breach: What do you need to consider under GDPR?

With many changes to our working practices on the horizon it’s easy to forget the importance of understanding what to do when things go wrong. There are specific requirements in GDPR setting out what we should do if we have caused a “personal data breach”, none more obvious than the need to report it within, ideally, 72 hours. First let’s consider the definition of a Personal Data Breach: “A personal data breach means a breach of security leading to the accidental or unlawful

What are DPIAs and when are they required under GDPR?

Mar 15, 2018

What are DPIAs and when are they required under GDPR?

Many firms and organisations will be familiar with the concept of a Data Protection Impact Assessment (DPIA) – they have been recommended by the Information Commissioner’s Office (ICO) for a number of years. But with the introduction of the General Data Protection Regulation (GDPR) on 25 May 2018, DPIAs will no longer be just best practice, they will be mandatory in certain circumstances. So what are they, and when do firms need to undertake them? In short, DPIAs are risk ass

Breach Reporting under GDPR: What You Need to Know

Mar 7, 2018

Breach Reporting under GDPR: What You Need to Know

One of the changes to be introduced under the General Data Protection Regulation (GDPR) is the requirement to report breaches to the Information Commissioners Office (ICO) or the data subject once certain conditions have been met, namely a personal data breach. A personal data breach is exactly what you think it would be, losing personal data. However, it is slightly wider than that, a personal data breach is defined as “a breach of security leading to the accidental or unlaw