Four Tips on Ensuring Good Compliance With the GDPR in the UK

The General Data Protection Regulation (GDPR) affects every organisation in the UK that handles personal data. Given that handling staff names and addresses constitutes personal data, the GDPR impacts practically every UK business. The Information Commissioner’s Office (ICO) exists to enforce GDPR rules and issue hefty fines of up to £17.5m for non-compliance. This article explores four tips for ensuring good compliance with the GDPR.

What is the General Data Protection Regulation?

The GDPR sets data protection rules for UK organisations. Its primary purpose is to ensure that UK businesses obtain, handle and process personal data safely and reasonably. 

One of the GDPR’s leading data protection principles is that UK companies should only record and store necessary personal data. For example, if a customer walks into a retail store and asks for a home delivery, the GDPR would allow the collection of their name and home address (but not their national insurance number or PIN code).

Let us now explore four tips for ensuring good GDPR compliance. 

1. Good Cyber Security Practices

The ICO and GDPR make clear that all UK organisations should prioritise cyber security. This is because the primary purpose of the UK GDPR is to protect personal information from unauthorised use.

Naturally, any theft of personal data by hackers and cybercriminals constitutes a likely GDPR violation through the unauthorised use of that information. This especially applies where the ICO finds that your business could have carried out better preventative measures before the cyber intrusion.

These preventative measures help reduce the otherwise high risk of personal data breaches, which helps your business remain GDPR compliant.

2. Detailed Privacy Policy on Your Website

A suitable privacy policy can help your company demonstrate GDPR compliance, particularly if your business has a website or social media presence.

Most privacy notices detail how your organisation collects, handles and stores personal information. This helps your business fully inform individuals about using their personal data.

A good privacy policy will be easy-to-understand and avoid ‘legalese’. The ICO disapproves of privacy policies that use technical jargon and cause confusion to the general public.

Instead, most privacy policies should concisely and openly explain the following points:

• the information types your company will process and keep;
• the reasons behind collecting personal data;
• the right of individuals to complain to the ICO about data mismanagement;
• the lawful purpose behind the collection of personal information;
• your data audit and deletion process; and
• the identifies of any third parties who may have sight of personal data.

Due to these points, many business owners instruct expert lawyers to assist with their privacy policies rather than taking their chances on internet templates. This is primarily because an unsuitable privacy policy may still constitute a GDPR violation due to failing to achieve its purpose.

3. Regular Data Audits and Data Deletion

The ICO and GDPR expect your business to review the personal information in its possession continuously. The easiest way of doing so is to ensure the carrying out of regular data audits. These involve determining whether to keep or delete personal information.

Your company must only keep information that is accurate and relevant. If information is outdated, it is not likely to be relevant or accurate anymore, and you should consider deleting it.

Some businesses mistakenly believe you can only delete personal data with the individual’s consent, but this is not always true. Instead, any information that serves no useful purpose should be subject to review.

4. Follow a Reasonable CCTV Policy

Most UK businesses utilise CCTV as a crime prevention and security measure. The GDPR allows your company to do so but sets some boundaries on your CCTV system use.

Accordingly, having a well-worded CCTV policy and following its contents can benefit your business. Whilst CCTV policies can vary, the majority of them will confirm some of the following points:

• the placement of warning signage near CCTV cameras;
• the areas covered by CCTV cameras;
• the fact that your business will delete CCTV footage when no longer necessary;
• the main reasons behind CCTV camera usage (including crime prevention and security); and
• the person in charge of CCTV footage (usually alongside their email address or telephone number).

The ICO treats CCTV violations as privacy violations, so ensuring CCTV policy compliance can reduce the risk of ICO fines.

Key Takeaways

Ensuring good GDPR compliance is essential for several reasons, the most important of which relate to safeguarding consumer confidence and avoiding ICO fines. The GDPR is a complex and lengthy beast. As such, many business owners obtain expert legal assistance with their data audits, training and documentation.

If you need help ensuring good GDPR compliance, our experienced Data, Privacy and IT lawyers can assist as part of our LegalVision membership. For a low monthly fee, you will have unlimited access to lawyers to answer your questions and draft and review your documents. Call us today on 0808 196 8584 or visit our membership page.  

Frequently Asked Questions