Compliance Insights Articles

High on the FCA’s cross-sector priorities for 2019/20 is ‘operational resilience’. The Regulator has recently turned its attention to technological changes and advances, particularly where these might impact on consumers or on regulator supervision, so it’s no surprise that high on the agenda is potential disruption caused by failure – or something more nefarious – of IT systems and other technologies. Acknowledging that apart from the increasing use of new technologies in fi

With vulnerability high on the FCA’s agenda for 2020, financial services firms have an eye on its new guidance document, which seeks to clarify what the regulator expects to see in terms of culture, product design, staff training, and support options. The FCA’s response and final guidance is due in the first half of 2020, but the guidance document as it stands provides a clear impression of where firms should be heading in their treatment of vulnerable customers in 2020. But

Following the implementation of the General Data Protection Regulation eleven weeks ago, the Information Commissioner’s Office have published a suite of guidance documents for all types of firms, helping to interpret the new rules and guide firms to apply the rules in practice. This is particularly helpful for firms experiencing some confusion about some of the more complex parts of the Regulation. The new guidance provides a helpful run-down of the process of undertaking a D

In this article we’ll be taking a look at how to ensure physical records processes don’t fall foul of the General Data Protection Regulation. The headlines in the run-up to implementation made much of the Regulation’s impact on digital data, with plenty of focus on the changes the tech titans were required to make to online and digital platforms. All firms, however, should be aware of the obligations the GDPR places on business with regard to physical – paper and hard-copy –

It’s been just six weeks since the GDPR came into effect and the initial signs are that the public are aware of, and are exercising, their new rights. An article in The Guardian states that the Information Commissioner’s Office has reported an increase in both breach notifications and in data protection complaints within the first four weeks after the implementation. The GDPR provides eight rights for individuals, building on previous rights enshrined in the UK's Data Protect

With the 25th May implementation date for the General Data Protection Regulation looming at the end of this week, our handy guide to making good use of the final few days will help you to ensure compliance before the deadline. Regulatory change can be daunting, and both the sheer number of new rules and the much talked about consequences of getting it wrong can be intimidating. There’s no one ‘right way’ to go about preparing for the GDPR, and whether arrangements have been u

There have been plenty of articles about the risks and consequences of non-compliance, with most focusing on the maximum penalties, and a few suggesting that some firms believe that the consequences have been over-stated. Whilst we’re pleased to say we’ve not come across anyone in our sector that is not taking compliance seriously, it’s a good idea to consider the differences that the change from the Data Protection Act 1998 to the GDPR will have on sanctions. The count-down

Out with the old and in with the new. The rules relating to Data Protection are about to see the most dramatic change in years, if not ever, with the soon-to-be-implemented EU Directive 2016/679 also known as the ‘General Data Protection Regulation’ (GDPR). With drastic changes on the horizon, Data Processers are inevitably starting to feel the strain as the May 25th deadline looms in the not-so-distant future. Besides the apparent never-ending changes necessary for a firm to

With many changes to our working practices on the horizon it’s easy to forget the importance of understanding what to do when things go wrong. There are specific requirements in GDPR setting out what we should do if we have caused a “personal data breach”, none more obvious than the need to report it within, ideally, 72 hours. First let’s consider the definition of a Personal Data Breach: “A personal data breach means a breach of security leading to the accidental or unlawful

Many firms and organisations will be familiar with the concept of a Data Protection Impact Assessment (DPIA) – they have been recommended by the Information Commissioner’s Office (ICO) for a number of years. But with the introduction of the General Data Protection Regulation (GDPR) on 25 May 2018, DPIAs will no longer be just best practice, they will be mandatory in certain circumstances. So what are they, and when do firms need to undertake them? In short, DPIAs are risk ass

One of the changes to be introduced under the General Data Protection Regulation (GDPR) is the requirement to report breaches to the Information Commissioners Office (ICO) or the data subject once certain conditions have been met, namely a personal data breach. A personal data breach is exactly what you think it would be, losing personal data. However, it is slightly wider than that, a personal data breach is defined as “a breach of security leading to the accidental or unlaw