how to make a business gdpr-compliant checklist

action

(✔)

only process personal data in accordance with the data protection principles. this means, for example, that you must be clear on what ‘processing’ is and what your business does with personal data (both internally and externally).

ensure that you have a legal ground (or ‘legal basis’) for processing any personal data. legal bases include, but are not limited to:

• the data subject (ie the individual to whom the data relates) has consented to the processing

• the processing is in the public interest (eg a local authority using personal data to collect council tax)

• the processing is in a business’ legitimate interests (a legitimate interest assessment (lia) will need to be carried out)

review any existing processes for obtaining consent from data subjects and ensure consent is valid. you should keep some form of record of consent (eg of how and when consent was given, and by whom).

ensure that you offer a proper process for individuals to withdraw consent at any time and notify them of their right to do so. 

consider whether your processing of personal data is likely to result in a high risk to the rights and freedoms of individuals (eg if you are processing children’s personal data). if so, make a data protection impact assessment (dpia) to help you identify and minimise data protection risks.

where a dpia was carried out, determine whether an appropriate policy document (apd) is needed.

ensure that you comply with data protection laws when dealing with staff members’ personal data.

make a data protection policy to inform your employees how you use their data and what principles they must adhere to when handling personal data.

make a website privacy policy that indicates what personal data is being collected on your website, the purpose of collection, how individuals can access this data. this can help to protect your business against data mining and scraping.

ensure you are aware of your obligations when data subjects make a data protection request (eg asking for their data to be erased or corrected), including what steps you have to take and how long you have to respond.

be sure to understand the laws and regulations around international transfers of personal data and to only transfer personal data outside the uk where adequate data transfer safeguards (eg standard contractual clauses) have been put in place.

if you are outsourcing data processing to a third party (eg a third-party service provider), make a data processing agreement (dpa) to ensure the safety of the personal data.

tale steps to keep all personal data secure, including by:

• adopting all relevant gdpr documents

• ensuring the security of all computers and networks (eg through strong passwords and multi-factor authentication)

• managing security risks by adopting a clear information security policy

• ensuring the physical security of the business premises (eg by hiring security guards or using security products)

understand your obligations for reporting a data breach (ie a breach of security resulting in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data).

consider appointing a specific person or setting up a dedicated team to deal with data breaches.

keep records of your processing activities (including why you are processing certain personal data, how long personal data will be retained for, and who it will be shared with) and review these regularly.

certain businesses based in the uk must, under the eu gdpr, appoint an eu data representative as a local contact for data subjects and supervisory authorities. businesses generally need to do this if they offer goods or services and/or monitor the behaviours of individuals in the european economic area (eea).

for more information, read eu representatives.