October 9, 2017

The 12 steps the ICO recommends taking now are as follows:

1. Awareness: an organisation that is a “Competent Authority” under Schedule 7 of the Bill or has statutory functions for any of the law enforcement purposes, should make sure that key people are aware that the law is changing from May 2018;
2. Information held: organisations should document what personal data they hold, where it is held, where it came from, with whom it is shared, and who is responsible for it. Organisations should also identify what personal data is being processed under Part 3 of the Bill and what is being processed under other parts of the Bill and the GDPR;
3. Lawful basis for processing personal data: the lawful basis on which data is processed should be identified and privacy notices explaining it updated;
4. Consent: Organisations that rely on consent should consider whether it is appropriate or whether another lawful basis should be used. If consent is appropriate then how it is sought, recorded and managed should be reviewed;
5. Privacy notices: these should be reviewed, updated and made easily accessible;
6. Individuals’ rights: procedures should be checked to ensure they cover all the rights individuals may have, including deletion, so that organisations know how to respond within the specified timescales;
7. Data breaches: ensure that the right procedures are in place to identify, manage and investigate a breach;
8. Data protection by design and DPIAs: organisations should make sure they are familiar with the ICO’s code of practice on privacy impact assessments as Data Protection Impact Assessments will be mandatory where any processing is likely to result in a high risk to the rights and freedoms of individuals;
9. Data Protection Officers: organisations should ensure that someone is designated to take responsibility for data protection compliance and assess where this role will sit within the organisation’s structure and governance arrangements.
10. Logging: logs of processing operations must be kept in automated processing systems;
11. International: procedures for transferring or sharing personal data across borders should be reviewed to ensure that they are compliant; and
12. Sensitive processing: organisations undertaking sensitive processing will need to ensure that they are compliant with the requirements of the new legislation, including having an appropriate policy in place.

To read the ICO’s 12-step guide in full, click here.