GDPR is the word on everyone’s lips, and here at Microbyte we’re getting asked about it a lot. Many of you are worried about the hefty 4% fine for offending companies, but if you’re already taking data seriously, there’s no need to panic.
General Data Protection Regulation will come into effect next May, but most of the laws and concepts it outlines are already being put into practice. Some of the key new guidelines and regulations include:
- More stringent regulations around responsible data outsourcing.
- Reporting all data breaches – this is already practised within organisations such as the NHS, which have automated systems that know whether to report concerns.
- Data Protection Officers – people in your business, who understands what you are doing with data, where it is flowing, how it is being used etc.
- Data Protection Impact Assessments – a risk assessment around data, making sure everyone is considering the real impact of breaches.
- Right to erasure – in our view, this is long overdue and this aims to guarantee when people wish to be removed from a database, they can be with no hassle.
Of the 17000 cases investigated by the ICO last year, just 16 ever resulted in fines, so before starting to panic, consider the broad spectrum of businesses these investigations must have been spread over! In the current climate however, it is right and important that companies demonstrate just how seriously they take data and make the most of the ICO to help on that journey.
Unfortunately, there’s no quick course or webinar that will make you compliant, because compliance itself is a moving target. What businesses need to do is prove they’re doing everything reasonably possible to take care of data, whether that’s moving data to the Cloud, internal audit processes, encryption etc.
Even though the guidelines might appear to take a new approach to data protection, in our view we actually need to start by going back to basics and asking ourselves key questions. Are we being sensible? Do we trust the measures we have in place? It’s a good time to look at fundamental security safeguards from passwords to data storage and transportation.
Many of you will be familiar with Microbyte’s NetAdmin process, also referred to as our Standardisation Checklist. We have already started implementing more checks around basic data protection, and these will of course evolve as we learn more over the coming months from the ICO.
There is always more that can be done, but let’s get back to basics and start taking data seriously before panicking about fines from a framework which was put in place to help us not hinder.
For more information about how we are planning to help move our clients forward feel free to contact us.
