Recent research has indicated that the majority of businesses have not fully prepared for the implementation of the GDPR.
Set to come into effect on 25 May 2018, the General Data Protection Regulation (GDPR) will change the existing data protection regime in the EU.
The main aims of the GDPR are as follows:
- To introduce a base line across the EU for organisations to comply with
- Greater security for EU personal data
- Enabling citizens to have greater control over their personal data
In order to achieve this, the GDPR will introduce enhanced protection for individuals by bringing in new rights as well as maintaining those that already exist. Citizens, or so called ‘data subjects’ will have the right to erasure, meaning a business must erase any data that they possess on that individual. This encompasses all kinds of data such as call logs, health records and CCTV, in addition to the more standard metadata stored on computers or servers.
As well as this, the GDPR will also introduce a right to request for personal data rectification. Where information on a subject has been processed incorrectly, they are able to request its amendment. Similarly, individuals will also have a right to data portability under the new provisions.
As holders of large quantities of personal data, law firms have been urged take notice of the GDPR and begin preparations for its upcoming implementation.
A number of steps are considered essential in this process, allowing firms to review their approach to data protections, and introduce new measures which will comply with the new provisions. This could also be seen as an opportunity for firms to improve their existing processes and streamline the way in which they process data.
A summary of the recommended steps is as follows:
- Observe and review how data is currently collected
- Nominate a Data Protection Officer (this can be outsourced if needed)
- Ensure processing methods are prepared
- Keep records to illustrate continual compliance
- Observe and review consent and data protection notifications
Further information on the GDPR can be accessed here.
