When?
GDPR will apply in the UK from 25 May 2018

What’s Changed?
The GDPR introduces strict requirements for collecting, storing, processing and managing personal
data. ‘Personal data’ is information relating to an identifiable person who can be directly or indirectly
identified by reference to an identifier. You must also have a valid lawful basis to process personal
data.

The Aim?
The aim of the GDPR is to protect all EU citizens from privacy and data breaches in an increasingly
data-driven world and applies to ‘controllers’ and ‘processors’.

A controller determines the purposes and means of processing personal data.
A processor is responsible for processing personal data on behalf of a controller.

Legal Obligations
If you are a processor, the GDPR places specific legal obligations on you e.g. you are required to
maintain records of personal data and processing activities. These obligations for processors are a
new requirement under the GDPR. However, if you are a controller, you are not relieved of your
obligations where a processor is involved – the GDPR places further obligations on you to ensure
your contracts with processors comply with the GDPR.

Key Changes
Consent
Companies will no longer be able to use long illegible T’s and C’s full of complicated legal language.
Consent must be freely given, specific, informed, unambiguous and be a positive opt-in. Consent
cannot be inferred from silence, pre-ticked boxes or inactivity. It also must be as easy to withdraw
consent as it is to give it. Explicit consent requires a very clear and specific statement of consent e.g.
Customers must respond with a “Yes”

Penalties
Under GDPR organizations in breach of GDPR can be fined up to 4% of annual global turnover or €20
Million (whichever is greater). This is the maximum fine that can be imposed for the most serious
infringements. There is a tiered approach to fines. It is important to note that these rules apply to
both controllers and processors – meaning ‘clouds’ will not be exempt from GDPR enforcement.

Increased Territorial Scope (extra-territorial applicability)
GPDR will apply to the processing of personal data by controllers and processors in the EU,
regardless of whether the processing takes place in the EU or not. The GDPR will also apply to the
processing of personal data of data subjects in the EU by a controller or processor not established in
the EU.

This is a quick reference guide to GDPR, for full details please visit the site (link).  ICO. 2018. Guide to the General Data Protection Regulation (GDPR). [ONLINE] Available at: https://ico.org.uk/for-organisations/guide-tothe-general-data-protection-regulation-gdpr/ [Accessed 12 March 2018].

EUGDPR.org. 2018. GDPR Key Changes. [ONLINE] Available at: https://www.eugdpr.org/key-changes.html [Accessed 12 March 2018].

Data Subject Rights
Breach Notification
Breach notification will become mandatory in all member states where a data breach is likely to
“result in a risk for the rights and freedoms of individuals”. This must be done within 72 hours of first
having become aware of the breach. Data processors will also be required to notify their customers,
the controllers, “without undue delay” after first becoming aware of a data breach.

Right to Access
Part of the expanded rights of data subjects outlined by the GDPR is the right for data subjects to
obtain from the data controller confirmation as to if personal data concerning them is being
processed, where and for what purpose. Further, the controller shall provide a copy of the personal
data, free of charge, in an electronic format.

Right to be Forgotten
Also known as Data Erasure, the right to be forgotten entitles the data subject to have the data
controller erase his/her personal data, cease further dissemination of the data, and potentially have
third parties halt processing of the data. The conditions for erasure, as outlined in article 17, include
the data no longer being relevant to original purposes for processing, or a data subjects withdrawing
consent. Where a customer asks for their data to be removed for valid reasons, we must comply
where possible.

Data Portability
GDPR introduces data portability – the right for a data subject to receive the personal data
concerning them.

Privacy by Design
At its core, privacy by design calls for the inclusion of data protection from the onset of the
designing of systems, rather than an addition. More specifically – ‘The controller shall implement
appropriate technical and organisational measures in an effective way to meet the requirements of
this Regulation and protect the rights of data subjects’. Controllers should only hold and process the
data that is absolutely necessary for the completion of its duties (data minimisation), as well as
limiting the access to personal data to those needing to act out the processing. Privacy by Design
also includes ICO’s. All Broker’s must obtain an ICO from; https://ico.org.uk/fororganisations/register/. This confirms that every data controller (e.g. organisation, sole trader) who is processing personal information to register with the ICO unless they are exempt.

Data Protection Officers
Under GDPR it will not be necessary to submit notifications/registrations to each local DPA of data
processing activities. Instead, there will be internal record keeping requirements, and DPO
appointment will be mandatory only for those controllers and processors whose core activities
consist of processing operations which require regular and systematic monitoring of data subjects,
e.g. an organisation that carries out large scale processing of special categories of data, such as
health records, or information about criminal convictions.