Blog
Jan
11
Do you know your business data basics?
Last month we created a series of social media posts, The 12 Days of Data Christmas, sharing the key things you need to do and have in place to ensure you have your data essentials in order.
As your time is precious, we have created this blog with these top 12 tips, so you can access all the relevant information with just one click!
Remember to bookmark this page for future reference if you have any data questions in the future.
1. Register with the Information Commissioners Office (ICO)
The ICO is the UK’s independent body set up to uphold information rights.
Every organisation or sole trader who processes personal information needs to pay a data protection fee to the ICO, unless they are exempt. If you haven’t registered, don’t delay, do it today: https://ico.org.uk/for-organisations/data-protection-fee/
For most small businesses the fee is £40 per year or £35 if you choose to pay by direct debit.
2. Do you know what data you collect and use?
The first thing to do is a data audit.
Keep it simple and start by making a list of all the data you collect, how you collect it, why you need it, who you share it with, where you store it.
We take a deeper dive on this over on our blog, which you can find here:
3. How secure is your data and where is data stored?
Now you have established what data you collect and where it is stored, you need to look at how secure that data is.
Do you use encryption and multifactor authentication? Is it backed up? Is your data stored in the UK, EU or somewhere else?
Cloud data storage is an excellent solution, but if the data is stored outside the UK you are making a restricted transfer of personal data. This means you have additional GDPR obligations to comply with.
This is also the same for third party applications, for example, your CRM database or email marketing platform. Find out where the data is being stored.
Keeping everything on your computer is also risky as you may lose the data. You may not have a breach, but from a business perspective could you afford to lose everything?
4. Who are your Data Processors?
If you look back to yesterday’s post you’ll see we talked about third party applications to store personal data on, for example a CRM database. The organisations that provide these applications are data processors.
You also need to consider if you are outsourcing any of your processing activities to someone outside your organisation. For example, do you use an outsourced HR service or a Virtual Assistant?
If someone processes personal data on your behalf, and this includes just storing the data, you will need to put in place a data processor contract between you (the data controller) and the third party doing the work on your behalf (the data processor).
5. Data Sharing – what you need to know.
Data sharing is when two or more businesses agree to share personal data for a joint/common purpose. That said you must have at least one lawful basis for sharing data, the lawful basis that’s right for you will depend on the reason you want or need to share the data
For example, a product based business can share data with their courier company for delivery, so they can fulfil their contractual duty.
Here are our top tips when sharing data with another organisation:
- Keep a record of the data you are sharing, how you’re sharing it and your reason.
- Only share necessary information.
- Send the data securely and to the correct person.
- If your data sharing will be routine, make sure you have a data sharing agreement in place.
For more information visit the ICO’s Data Sharing Information Hub: https://ico.org.uk/for-organisations/data-sharing-information-hub/
6. Have you heard of ROPA?
It’s a Records of Processing Activities document. Once you have completed your data audit and know what data you are collecting and processing, you must document this in writing. This is where your ROPA comes in.
The ICO provide templates for both data controllers and processors, which can be found on their website: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/documentation/how-do-we-document-our-processing-activities/
Remember, if you are a data processor, for example a HR Consultant or VA, you will also need to complete a data controller document as you will be collecting personal data relating to your own business activities, e.g. your client data.
7. Privacy Notice.
You probably hear the term privacy notice quite a lot, but do you know what one is?
Simply put a privacy notice gives an individual specific information about what you will do with their personal data when they hand it over to you.
If, as part of your business activities, you collect and use someone’s personal data you have a legal obligation under the General Data Protection Regulation (GDPR) to provide them with a privacy notice.
Not sure where to start? Head over to our 2-part blog which gives you the ins and outs of writing your own Privacy Notice: https://dunwelldataprotection.co.uk/privacy-notice-part-1/
8. Do you know what to do if you have a data breach?
Would you recognise whether it classifies as a breach or not?
A personal data breach is the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. It can have been caused accidentally or deliberately.
If you think there’s been a breach, grab a pen and notebook (or your computer) and document everything.
Some personal data breaches need to be reported to the ICO within 72 hours of you becoming aware of it.
You can find out more about personal data breaches, what to do and if it is reportable or not by completing the online self-assessment on the ICO website: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/personal-data-breaches
9. Have you ever considered the risks to individuals associated with collecting and processing personal data?
What risks do you have in your business that can impact someone’s rights and freedoms?
A data protection impact assessment (DPIA) is a fantastic tool for identifying and minimising data protection risks and must be completed for processing that is likely to result in a high risk to individuals.
But what is classed as a ‘high risk’ to individuals?
The UK GDPR says you must do a DPIA if you plan to:
- use systematic and extensive profiling with significant effects;
- process special category or criminal offence data on a large scale; or
- systematically monitor publicly accessible places on a large scale.
For guidance and a DPIA template visit the ICO website: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-impact-assessments/
Whether you are required to do DPIAs or not, keeping a privacy risk register will help you identify and mitigate risks involved with collecting and processing personal data.
10. Individual’s Rights.
We’re sure you are aware of the 8 rights individuals have under GDPR, but just in case here they are:
- The right to be informed
- The right of access
- The right to rectification
- The right to erasure
- The right to restrict processing
- The right to data portability
- The right to object
- Rights in relation to automated decision making and profiling.
The right to be informed is covered by your privacy notice, after that the right of access and the right to erasure are the 2 most common rights individuals will use.
Right of Access: individuals have the right to access and receive a copy of their personal data, commonly referred to as a subject access request or ‘SAR’.
Right to erasure, also known as the right to be forgotten, is when an individual asks for you to erase the data you hold about them. This right is not absolute and only applies in certain circumstances. If you are obliged to erase the personal data you hold on an individual, don’t forget to go through your emails!
If you receive a SAR or an erasure request and would like to talk it through with someone, please contact us by email info@dunwelldataprotection.co.uk.
For more information on Individual Rights under GDPR visit: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/
11. Third Part Data Sharing Requests.
If the police asked you for the personal data of a member of staff or a client for an ongoing investigation, would you just hand it over to them?
Third party data requests are when someone asks for information about an individual (not themselves, otherwise it would be a SAR). This includes, but is not limited to, the police, local authorities, bank fraud teams, HMRC, regulatory authorities, MI5 even!
When it comes to third party requests, you should always question what it is they need and why. You have got to be able to justify why you provided the personal data to the third party and where appropriate the exemption you are relying on to make the disclosure to the third party. It is also important to redact any personal data pertaining to other individuals and/or is not relevant to the case.
P.S. That was a trick question, it doesn’t matter who asks for the information, they do not have an automatic right to access.
12. Direct Marketing – there’s more to it than just GDPR!
Direct marketing is a great way to reach potential and existing clients, showcasing your knowledge, products and/or services, the most common of which we all see is Email Marketing.
When it comes to email marketing, we always hear people talking about GDPR, but did you know there is another regulation specifically relating to electronic direct marketing?
PECR – The Privacy and Electronic Communications Regulations.
However, when the ICO Direct Marketing Code of Practice stands at 124 pages long, it can seem like a minefield, and you’d be forgiven for giving up.
Last year we published a series of blogs that will guide you through the essentials of email marketing and what you need to have in place to comply with current data protection laws: https://dunwelldataprotection.co.uk/understanding-the-terminology-used-in-gdpr-pecr/