The arrival of the General Data Protection Regulations (GDPR) means you need to document what you do.
Documentation, is that something new?
One of the less talked about areas of GDPR is the need to keep documented records of your data processing activities that relate to data protection. The Information Commissioners Office (ICO) has indicated that in any investigation their first request will always be to review your documentation. If you have no records relating to data protection they will take a dim view and assume you have been cavalier in handling people’s personal data. The documentation required to prove you have given thought to the issues and have put measures in place in not onerous or complex.
At this stage, no one knows how the ICO will police the GDPR when it comes into force. However, it is very likely that they will want to consider whether an incident is accidental and to some extent unforeseen or whether it is a result of negligence or much worse, recklessness. The value of documentation is that you can demonstrate that you have considered the issues and may move you down the scale from the reckless and negligent categories in terms of possible sanctions against you.
Privacy Policy
A privacy policy is a document that outlines the approach taken by the whole business in regard to data protection across all areas of the business where people's personal data is held and processed by the business. This doesn’t have to be a large, cumbersome document as it describes the overall policy and not necessarily the detailed procedures that you may need to implement to carry out the policy.You should consider having separate Privacy Statements in place to cover outward-facing parts of the business such as your website. This would describe your policy in the context of data you collect or use on the website. You will also need to consider detailed Privacy Notices at the point where data is actually collected or used, for example a sign-up form for your mailing list. The need for privacy notices at the point you collect data is a specific requirement under GDPR and the ICO has some good examples on their website.
Data Processing Record
It is a legal requirement under GDPR that you have documented records covering all areas where you process personal data. This is not a record of each time you process data but an overall description of what you are doing, the legal basis for doing it, whose data is being used, what type of data, how long you will keep the data, contact details within your organisation, whether third parties are involved and security measures to protect the data. This type of document has many names but we prefer to call it a Data Processing Record (DPR) and you should have one for each type of data processing that you do.
Data Protection Impact Assessment
Alongside each DPR you may need to document an impact assessment of the risks to the privacy of the people whose data you are processing. It is not an absolute requirement of the GDPR that you carry out a Data Protection Impact Assessment (DPIA) except in specific situations. If you process sensitive data about people’s finance, health, criminal records or political affiliations then you must. If you are processing data relating to children or carrying out large-scale or regular processing then again you must. Sadly, the terms large-scale and regular don’t have hard definitions and so can be interpreted in many ways. It is probably sensible to document some form of impact assessment for all but the most trivial sets of data as this demonstrates that you have considered the issues.
Retention Schedule
The list above mentions the lifetime of the data. The GDPR expects that you will have specific rules about how long you keep data and the steps you take to delete data you no longer use. This is called Retention and shouldn’t be ignored. You may need to keep some data in your accounting system for up to six or seven years for tax and other reasons. However, this should be disposed of after the retention period has elapsed. Other data such as personnel records will have a shorter lifetime after an employee leaves, whereas unsuccessful job applicants' information should probably be disposed of very quickly unless you can demonstrate a real reason to keep them. In order to keep track of this you should keep a central document that lists all the data you deal with and identifies the lifetime of the data. For each you should describe the process of deleting, archiving or otherwise disposing of the data and keep a record of regular checks to ensure it has been done.
Our trained and accredited in-house data protection staff can discuss any aspect of data protection with you to help you ensure your digital marketing activities are compliant. As always, we provide information for discussion and it should not be taken as guidance in the absence of your own legal advice.
