Uncertainty around Brexit has caused some confusion as far as data privacy is concerned, with some business owners unsure on how to proceed with their own data protection policies – and whether GDPR will apply after Brexit or not. In this article, we discuss data privacy post-Brexit and the most likely outcomes as a result…
Individuals have the right to access their personal data and organisations are legally obligated to enable this right if they are the controller of that information. Would you know how to handle a subject access request? In this article, we cover the right to access and the correct procedure for processing such requests. Under the…
If you need to know one thing about the GDPR, it’s this: every organisation that processes personal data must comply with it. Those who don’t risk investigation and possible enforcement from the ICO – the Information Commissioners’ Office. In the most severe cases, they may impose a fine of up to £17m, or 4% of…
Under the GDPR, the data cookies collect is considered personal if it can identify an individual via their device. If you use cookies that do this, you must gain consent from the user to collect and use that data. But can you do that without turning customers off? The EU’s General Data Protection Regulation (GDPR)…
Is an organisation legally required to appoint a data protection officer? Not always. Regardless, should your organisation appoint one anyway? That’s the real question. In this article, we discuss whether a GDPR data protection officer is an essential hire. In order to meet their data protection requirements under the GDPR, organisations need expert advice and…
With GDPR compliance now a legal requirement for all organisations, many webmasters are looking for a quick way to get their websites compliant. Is copying someone else’s privacy statement a good way to do this? In this article, we discuss just that. The purpose of the EU’s General Data Protection Regulation (GDPR) is to provide…
If your processing activities could uncover high-risk data, the GDPR requires you to carry out a privacy impact assessment. It is also good practice in some cases to carry out an assessment, irrespective of data risk category, to demonstrate accountability. In this article, we discuss the challenges to doing so. The EU’s General Data Protection…
As a payment merchant or service provider, securing payment card and cardholder information will be of the utmost importance to you. PCI DSS compliance can help you do just that. In this article, we navigate its requirements. PCI DSS (Payment Card Industry Data Security Standard) compliance is a mechanism for ensuring data security where payment…
Under the Data Protection Act 1998, the Information Commissioners’ Office (ICO) could only impose a monetary penalty of up to £500,000. The Privacy and Electronic Communication Regulation 2003 also gives the regulator the ability to impose a fine of £500,000 for poor marketing practices. This will change when the Electronic Privacy Regulation (ePrivacy) comes in…
Approaching a GDPR compliance project is a daunting thought – it involves the entire business and beyond, especially when you consider data transfers to your supply chain and wider business partners. Thanks to our experience of providing guidance to over 150 organisations, we can provide you with a simple step-by-step checklist of how to devise…
