info@stevensdrake.com
01293 596900
HomeAbout UsBusinessPersonalNews & ArticlesContactReceived a debt collection letter?Download our 'Income and Expenditure' form here

Are you ready for GDPR? - Contracts, record keeping and governance (8)

Posted
June 14, 2018

In addition to bolstering the rights of individuals, and increasing the level of fines applicable in the event of a breach the regulations make further provision to ensure that Data Controllers and processors effect good governance and to ensure transparency and accountability. 

Where the processing of personal data is carried out by a Data Processor on the controller’s behalf there is now a requirement for that relationship to be governed by contract.  Article 28(3), states

“processing by a processor shall be governed by a contract or other legal act…that is binding on the processor with regard to the controller and that sets out the subject matter and duration of the processing, the nature, and purpose of the processing, the type of personal data categories of data subjects and the obligations and rights of the controller”

Any business operating as a Data Controller will ultimately have responsibility for complying with and being accountable for compliance with the regulations.  It is suggested therefore that Controllers only appoint Processors who can provide ‘sufficient guarantee to implement the appropriate technical and organisational measures’.   Agreements should, therefore, ensure that they set out clearly the subject matter and duration of the processing, the nature and the purpose of the processing, the type of personal data and categories of data subject, and the obligations and rights of the controller. 

In order to demonstrate compliance with the regulation, businesses will need to ensure that they implement appropriate technical and organisational measures.   Both Controllers and Processors will have obligations under the regulations to maintain records, and in the case of Data Processors a record of all data processing activities carried out (Art 30).  However, some head space is provided for organisations consisting of less than 250 employees unless the processing is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional or processing includes special categories of data. 

There is consequently an expectation that organisations will put in place comprehensive, but proportionate, governance arrangements.   The undertaking of Data Protection Impact Assessments are now a requirement, and in particular where new technology is intended to carry out the processing.  These assessments are designed to assess the impact on the envisaged processing on the protection of personal data.  Any new technology or process should also confirm with the requirement of privacy by design.  Privacy by design is the concept that envisages that data protection is taken into account from the inception of a project, rather than being considered as an afterthought.  This approach, whilst not presently legislated for, has been encouraged.

The reality of the obligations placed on business and organisational bodies, in complying with the regulations, is that there will be a greater number of policies and procedures being required, and the need to document relevant processing activities.

Should you need any advice and assistance in looking at the contractual arrangements you have in place, or will need in place, or have concerns over the processes and procedures you have in place to ensure data protection under the regulations, then please contact Richard Burraston on 01293 596984 or by e-mail at Richard.burraston@stevensdrake.com or Paul Dungate on 01293 596981 or by e-mail at paul.dungate@stevensdrake.com

Share this article

Have you read our other blogs?

Are our discrimination laws working effectively?

Posted
September 4, 2019
Employment Law
Read More

Do you have to ‘blow the whistle’ to be a whistleblower?

Posted
September 4, 2019
Employment Law
Read More
View all Articles

Stay up to date with stevensdrake

Simply fill out your details below to receive stevensdrake's monthly newsletter, including regular topical articles, tips and upcoming events.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.