Much of the responsibilities that link to GDPR lie with the person who owns the business and the people who manage it. However, it has to be said that everyone in a business, no matter what work they do, is going to have some role to play in GDPR compliance.
More specifically, employees need to ensure that they understand how they can keep themselves and the data that they have access to, safe. This could be things such as email security, passwords and being aware of device encryption.
If an employee has a higher level of access to data, that could be personal, then they should have more GDPR training to reflect this.
The main areas of GDPR include data collection, data storage and personal data processing. This means that there will be several roles that fit into the areas, or that have a role that oversees all of these.
A business will likely have either data controllers or data processors, often who take charge of particular areas of GDPR in the workplace, depending on how much it relates to what they do as a business.
There should also be someone who is known as the Data Protection Officers, these will oversee the GDPR processes within the business and they will then report back to the CEO with the information that they are going to need to know.
GDPR was put in place to ensure that the data that relates to individuals is protected and does not get into the wrong hands.
The first thing that GDPR does is give individuals the right to be informed about whether or not their data is collected and how it will be used. They can also then, if they so wish, ensure that this does not happen and that companies will not collect and store personal data that relates to them.
More than this, GDPR ensures that individuals can check whether or not their data is complete and fix any issues that may be found in their data. It also gives them the right to request that data held about them, should be deleted and no longer stored.
As we have already looked at, employees do have a responsibility when it comes to GDPR. This will vary from place to place and of course, depend on the nature of the work that they do and the data that they have access to.
Here are some of the key employee responsibilities when it comes to GDPR.
The first thing that employees need to ensure that they do is handle personal data within the company in the correct way.
Consent and lawful processing
One of the main elements of GDPR is to focus on the consent of the individual, those whose data is held. They should consent to the collection and storage of their data, which is what makes it lawful to process it.
Data collection and storage best practices
Another key part of GDPR is to ensure that best practises are always followed when it comes to both data collection and storage. This is something that all employees should be aware of and make sure that they are doing. That way you are going to give yourself the best chance of being GDPR compliant.
Data should always be stored in a location that is in the EU, the data should be stored in a way that makes it easy to recover, change and delete (should consent be removed).
Security measures for personal data
It is also vital that during storage, there are certain security measures put in place that keep personal data protected. Data should be stored with encryption, which offers another layer of protection.
Another key aspect of GDPR and data protection is that employees are aware of what a data breach may look like and what they need to do to try and reduce the risks that these breaches can cause.
Definition of a data breach
A data breach is an incident where information is either stolen or taken from a system that holds it. More often than not this can happen without the owner of the system even being aware of the breach. But will often become apparent.
Reporting procedures
It is key that all employees are aware of what a data breach can look like and what needs to happen should one occur. There should be a procedure put in place that will report a data breach and highlight what then needs to happen next to reduce the risks of this breach and ensure that the data that is held (and that could be in the wrong hands) is as protected as possible.
Responsibilities in case of a breach
The overall responsibilities in the case of a data breach will lie with the owner of the data (this will usually be the owner of the business). However, any who holds a data position within the business will need to be involved with the breach and ensure that the correct procedures are followed to protect the data that is held and ensure that the risks are reduced as much as they possibly can be.
To ensure that GDPR Is followed within a business, you need to make sure that proper training is delivered to everyone within the business.
Of course, the level of GDPR training that is provided to an employee will entirely depend on the level that they are working at and the involvement that they have in handling data within the business.
It is always best that every single employee shows an understanding of the key elements of GDPR and that they can understand what it means and why it has been put in place
Then, it should follow the more involved aspects of GDPR such as how data is stored, how it is protected and what happens should there be a data security breach.
It is recommended that every employee be offered GDPR training when they join a business. This should then be followed by a yearly refresher course, at least. This then keeps everyone in the business aware and the key aspects of GDPR at the forefront of their minds.
Training can sometimes be something that is seen as a tick-box exercise and is not particularly focused on or considered as important. There are lots of ways that you can try and encourage people to listen and engage with the training that they are being given.
One way is to ensure that it includes practical examples and that it follows relevant case studies that relate to data breaches, data storage, data protection and what can happen when GDPR is not followed as it should be.
To ensure that GDPR is properly followed and that data is protected, legislation and regulations have been created which are legally required to be followed.
The key piece of GDPR legislation is the UK Data Protection Act 2018. This is the UK implementation of the GDPR and outlines the responsibility for ensuring that personal data is properly protected.
It covers a wide range of aspects of data storage but largely focuses on the fact that information that is held is done so in a way that is safe, fair, lawful and transparent too.
The UK DPA is only applied to those companies that are in control of processing personal data. However, the GDPR was created as a way to regulate the companies that process personal data, often on behalf of those controllers of data that are covered by the DPA.
Much of the UK Data Protection Act and the GDPR relate to those who hold a level of responsibility for data within a company. However, certain areas relate to employees too. One key feature is that employees should always feel able to raise an issue when it comes to data protection within their workplace and know where these should be reported.
The key regulatory body that relates to GDPR compliance in the UK is the Information Commissioner Office or the ICO.
The ICO is always focused on the interest of the public and ensuring that the information rights that relate to their data are always upheld. The ICO ensure that there is transparency when it comes to individuals’ data and that they can always be aware of the part that they all play in data privacy.
It is vitally important that GDPR is always followed and that it is a key aspect of the way that a business is run and the interactions that they then have with their clients or customers. There are a range of consequences that can occur due to non-compliance.
The most common consequence of GDPR non-compliance is that there will be a fine issued to the business. This fine can be up to £17.5 million for serious breaches of data, or 4% of your annual worldwide turnover, whichever is higher.
Smaller breaches will still incur a fine, however, more often than not there are other penalties. This includes warnings delivered to the business, a restriction on data in the business, suspension of data transfers and also a ban on data processing, either permanent or temporary.
Aside from the financial implication of GDPR breaches, or the impact it has on the service that a business can deliver, another key aspect of these breaches on the business is the reputational damage that it can cause.
When the individuals who work with the business or who know that their data is held by them, find out that there has been an issue with the way that their data is held, then they may feel that they simply cannot trust the business and feel that they are safe with them. They may remove their consent that relates to data, or they may decide that they want to go elsewhere with their business.
The consequences that have been outlined are aimed at the organisations as a whole. Whilst these fines etc. are often aimed at those who own the data (and the business) there can sometimes be a chance that a personal and private claim can be made against an individual.
These will be raised by the person whose data it is and will often relate to any financial losses, reputational damage or anything else that can occur from GDPR breaches or the processes not being followed properly.
Get in contact and we will
get back to you
Sign up today & receive a discount on your first course
We will keep you up to date with the latest news, updates and discounts.
