GDPR Compliance Guide | The Need-to-Know Guide to GDPR

This marks the date when the General Data Protection Regulation (GDPR) comes into effect. With less than two weeks to go, you will hopefully be well underway in ensuring your company’s compliance with GDPR, or else risk consequences that could dramatically impact its future. If you’re not quite there yet, or not sure where to begin, read on…

In this article, Method’s cybersecurity specialists outline what GDPR is, how your business will be affected in the coming weeks, how you can achieve GDPR compliance and the benefits it presents to your company.

What is GDPR?

In summary, GDPR is an EU data protection regulation, designed to shift control of personal data back to its rightful owner. This directive is in response to the growing threat of loss or theft of personal data as a result of cybersecurity breaches. From passwords and account details to contact information, many businesses today have accrued substantial data from their customers/visitors, which could be vulnerable to ever-growing IT security attacks.

The growth of these cybersecurity threats in 2017 is something businesses cannot ignore – the Online Trust Alliance (OTA) reported that the number of incidents worldwide increased from 82,000 in 2016 to 160,000 last year. The UK alone saw 33 million data records compromised in data breaches in 2017, which while a decline from 2016, still indicates that substantial personal data is at risk as a result of increasingly sophisticated cyber-attacks.

The 8 Principles of the GDPR Data Protection Act has been designed to curb this risk to personal data across Europe and minimise threats to customers online. These are:

1. All businesses must have legitimate grounds for collecting data from their customers.
2. Organisations must be open about their reasons for obtaining personal data and what they aim to use it for.
3. The data collected must only be adequate for its intended purpose, and not excessive.
4. All information held on customers must be kept accurate and up-to-date.
5. No personal data is held any longer than necessary for the intended purpose.
6. People must have the right to access their personal data held by an organisation to prevent it being used negatively.
7. All personal data must be kept safe and secure behind a company’s IT security defences.
8. Data should not be transferred to countries that do not share the same level of data protection.

What Will GDPR Change?

As of 25 May, UK businesses will have to demonstrate GDPR compliance to data protection officers, and will have 72 hours to disclose any serious data breaches to the Information Commissioner’s Office (ICO). Also among the raft of regulations companies must be aware of range from enhanced compliance procedures and data access requests to stringent reporting and disclosure procedures.

What are the consequences for failing to comply? Breaching GDPR can result in a fine of up to €20 million or 4% of your company’s annual turnover – whichever is the greater value. A fine of this size could be devastating for any company, but particularly SMEs across Europe.

It is therefore critical that your business takes action (if it hasn’t done so already) to ensure your IT security measures and data protection comply with GDPR. And, before you ask, no – Brexit will not the impact the UK’s implementation of GDPR.

It will come as some shock that, even with GDPR looming, many British businesses are still unprepared for these new regulations. A recent survey by ThinkMarble revealed that 73% of UK organisations are unaware of the lawful basis for processing personal data, while a quarter of these are unsure about where the personal data they are responsible for is currently held.

Certainly, there are steps to take to improve your understanding of how to protect and keep track of the personal data you hold and demonstrate to your customers you take the security of their information seriously. Our cybersecurity experts have helped businesses achieve respected Cyber Essentials accreditations that are in-line with GDPR requirements.

But, above all, if you are not yet prepared, now is the time to contact IT security specialists to guarantee your company is compliant with GDPR before the looming deadline.

The Steps Towards GDPR Compliance

Establishing your processes are in line with GDPR may seem like a daunting challenge, especially if you weren’t already aware of the regulations or the penalties associated with them. But, with the assistance of specialist IT cybersecurity professionals, you can prepare effectively for the ongoing duty of GDPR compliance to ensure you thrive in these new conditions.

Our team at Method IT will assess your company’s current IT infrastructure against the demands of GDPR, and through our consultative approach create a bespoke plan of action to fill any gaps and develop your cybersecurity systems accordingly.

One of the ways we achieve this, as mentioned above, is through guiding businesses toward their Cyber Essentials certification. This not only effectively supports your GDPR compliance and systems for protecting your valuable data, but demonstrates to both your peers and customers that you are committed to the safety of their information.

With our support, you will have all technical aspects of GDPR compliance in place in your company’s IT infrastructure, as we take everything step-by-step.

What are these steps? To ensure you’re prepared for GDPR, the ICO recommends you account for the following:

• Make key members of your team aware of the changes GDPR will introduce
• Conduct an information audit to document what personal data you hold, who it belongs to and what you’re allowed to do with it
• Check procedure to ensure the rights of individuals with regards to their personal data are accounted for
• Examine the legal basis behind any form data processing your business conduct, as well as how you are obtaining consent
• Ensure you have the systems and procedures in place to detect, report and investigate a personal data breach
• Determine who will be responsible for data protection compliance from May 2018 onwards (such as a Data Protection Officer)

It seems like a lot, but our IT security professionals help you respond to each of these efficiently and effectively, to guarantee your systems are up to GDPR standards.

The Benefits GDPR Will Bring To Your Business

Above all else, it is important not to see GDPR as another burden your business has to contend with, but as an opportunity to enhance your company’s online safety and attract more customers or clients.

If you can prove that your business complies with GDPR, you are far more likely to encourage trust and work from customers than those that fall short. Trust is a difficult commodity to come by online these days, but these regulations offer an environment where your customers’ trust benefits your bottom line.

Plus, it gives companies the impetus to enhance and refine their IT security systems. Through the introduction of innovative online backup solutions, managed firewalls, business continuity plans and other procedures, you have far more potential of overcoming data breaches and other forms of cyber-attack.

As well as this, a comprehensive data discovery audit will identify personal data stored throughout your vast IT infrastructure, and highlight any examples of duplicate data and out-of-date storage that your company pays to store. This housecleaning could streamline your storing of personal data, ensure nothing is misplaced and save you money in the long-run.

If you are yet to prepare for GDPR or you are stuck trying to understand the extensive regulations, Method IT are here to support you every step of the way. Our experienced cybersecurity specialists have familiarised businesses across Essex and London with GDPR requirements and helped prepare them for a future with these regulations in place.

From an initial consultancy session, we will evaluate your existing IT infrastructure and work alongside your team to fill any gaps with robust IT security solutions. With our support, you can rest assured your business can effectively report, manage and prevent personal data breaches and comply with GDPR for the long-term.

Act now on GDPR compliance. Call our experts today on 0345 521 6111 or email enquiries@method-it.co.uk for more information. Alternatively, visit our IT Security Landscape to page to discover the complete cybersecurity package for your company.