Blog

“Oh, we don’t collect personal data”, “I pay my £35 fee to the Information Commissioner every year, but don’t really do anything about data protection”, “data protection, that’s something I probably should know about but I don’t have time”.

These are just some of the comments that people say to me when I’m out and about at business meetings. There are lots of other comments made about how data protection doesn’t affect someone’s business but if I listed them all here it would just be a blog of statements!

When I then delve into the type of business they operate and what their business activities are, it is easy to identify that they are indeed collecting personal data of their clients and customers; and this can sometimes come as a surprise to them.

What every business needs to remember is that if you are collecting information from a living individual, which can be as simple as their name and contact details, to more detailed information such as financial details and medical history you have a legal obligation to process it all in line with the Data Protection Act.

So what does this mean for you and your business? Very simply put you need to make sure you comply with the 8 data protection principles, this means the data is:

• processed fairly and lawfully
• processed for a specific purpose or purposes
• adequate, relevant and not excessive
• accurate and kept up to date
• kept for as long as is needed and no longer
• processed in line with the rights of the individual
• safeguarded against unlawful processing, loss, destruction or damage
• not transferred to a country outside the EEA without appropriate protection in place

Some simple questions to ask yourself when collecting personal data are:

• Do I need all the data I’m asking for?
• Have I told the individual why I am collecting their data and what I am going to do with it?
• How am I going to keep it up to date?
• How long am I going to keep it for and how will I get rid of it when I no longer need it?
• Am I keeping it securely?
• If someone asks me for their personal data do I know what to do?
• Do my staff know how to process the personal data properly?

If you’re unsure about whether you are complying with the Data Protection Act we can help. You may want to opt to have a full compliance assessment undertaken. We work with you to identify the non-compliances and we recommend what you need to do to become fully compliant and can help you implement those recommendations. Alternatively you may prefer to opt for our advice and support helpline, where we can help with the day to day data protection aspects of running a business. Finally, you may just need some data protection training for you and your staff, this could be general data protection training or more specific training.

If you would like to discuss any of the services we provide please do get in touch with us.