Seven steps for businesses to get ready for the General Data Protection Regulation

As of May 25th, 2018, with the entry into application of the General Data Protection Regulation, there is one set of data protection rules for all companies operating in the EU, wherever they are based.

In order to help companies that do not handle personal data as a core business activity, such as SMEs that mainly deal with personal data of their employees or have lists of clients and customers, the Justice and Consumers department of the European Commission published a guide which highlights the few steps that need to be taken to get in line with GDPR’s new set of rules.

Personal data is any information that relates to an actual living individual (not  legal entities). This includes, for instance: name, surname, home address, e-mail address or location data from the map on your mobile. Typically, this would be the case of the data you might hold on your employees, your clients or your suppliers.

Step 1: Check the personal data you collect and process, the purpose for which you do it and on which legal basis

You have employees; you are processing their personal data based on the employment contract and based on legal obligations (e.g. reporting to tax authorities / social system).

You can manage a list of individual customers, for instance, to send them notice about special offers/adverts if you obtained consent from these customers. You don’t always need consent. There are cases when individuals will expect you to process their data. For instance, as a pizza merchant, you can process the delivery address to advertise one of your new products. This is called a legitimate interest. You must inform individuals about your intended use and stop processing such data if they tell you to do so. If you manage a list of suppliers or business clients, then you do it based on the contracts you have with them. The contracts are not necessarily in a written form.

Step 2: Inform your customers, employees and other individuals when you collect their personal data

Individuals must know that you process their personal data and for which purpose. But there is no need to inform individuals when they already have information on how you will use the data, for instance, when a customer asks you to do a home delivery.

You also have to inform individuals on request about the personal data you hold on them and give them access to their data. Keep your data in order, so when e.g. your employee asks you about what sort of personal data you have, you can provide it easily with no extra hassle.

Step 3: Keep the personal data for only as long as necessary

Data on your employees: as long as the employment relationship and related legal obligations. Data on your customers: as long as the customer relationship lasts and related legal obligations (for instance for tax purposes). Delete the data where it is no longer necessary for the purposes for which you collected it.

Step 4: Secure the personal data you are processing

If you store this data on an IT system, limit the access to the files containing the data, e.g. by a password. Regularly update the security settings of your system. (Note: the GDPR does not prescribe the use of any specific IT system) If you store physical documents with personal data, then ensure that they are not accessible by unauthorized persons; lock them in safe or a cupboard.

Step 5: Keep documentation on your data processing activities

Prepare a short document explaining what personal data you hold and for what reasons. You might be required to make the documentation available to your national data protection authority when it requests it. Such documents should include the information listed below.

Step 6: Make sure your sub-contractor respects the rules

If you sub-contract processing of personal data to another company, use only a service provider who guarantees the processing in compliance with the requirements of the GDPR (for instance security measures). Before you sign a contract, check if they have already changed and adjusted to the GDPR. Put it in the contract.

Step 7: Check if you are concerned by the provisions below

• To better protect personal data, organizations might have to appoint a Data Protection Officer (DPO). However, you don’t need to designate a Data Protection Officer if processing of personal data isn’t a core part of your business, is not a risky processing and your activity isn’t at a large scale;
  For example, if your business only collects data on your customers for home delivery, you do not need to appoint a DPO.
  Even if you need to make use of a DPO, he/she could be an existing employee tasked with this function in addition to his/her other tasks. Or it could be an external consultant; the same way many organizations use external accountants.
• You normally don’t need to carry out a Data Protection Impact Assessment
  Such an impact assessment is reserved for those that pose more risk to personal data, for instance, they do a large-scale monitoring of a publicly accessible area (e.g. video-surveillance). If you are a small business managing employees’ wages and a list of clients, you do not need to carry out a Data Protection Impact Assessment for those processing operations.

Fines

The data protection supervisory authorities are empowered to sanction infringements of the data protection rules. They can adopt corrective measures (such as an order or a temporary suspension of the processing) and/or impose a fine.

Their decision to impose a fine must be proportionate and based on an assessment of all the circumstances of the individual case. If they decide to impose a fine, the amount of the fine will also depend on the circumstances of the case, including the gravity of the infringement or if the infringement was intentional or negligent. They will also take your attitude and intentions into account.

If you wish to obtain more information:
1. Visit the European Commission’s online guidance on data protection reform – available in all EU languages
2. Consult your national Data Protection Authority

Original source: EC