Getting ready for GDPR

Newsletter issue - October 2017.

The new General Data Protection Regulation (GDPR), which will replace the existing Data Protection Act (DPA), takes effect from 25 May 2018. UK organisations that process the personal data of EU residents need to ensure systems are in place by then to enable compliance with new requirements.

The GDPR is more extensive in scope and application than the current DPA. The Regulation extends the data rights of individuals, and requires organisations to develop clear policies and procedures to protect personal data, and adopt appropriate technical and organisational measures.

The GDPR introduces a number of key changes for organisations including:

The government has confirmed that the UK's decision to leave the EU will not affect the commencement of the GDPR. Enforcing GDPR in the UK will be the responsibility of the Information Commissioner's Office (ICO).

The GDPR applies to 'controllers' and 'processors'. The definitions are broadly the same as under the DPA - i.e. the controller says how and why personal data is processed and the processor acts on the controller's behalf. Organisations that are currently subject to the DPA, are also likely to be subject to the GDPR.

Tough penalties can be imposed for non-compliance - organisations found in breach of the Regulation may be fined up to 4% of annual global turnover or 20m euros, whichever is the greater.

Further information on the GDPR, including details of the compliance requirements, can be found on the ICO website.

Don't miss out

Our monthly newsletter is a great way to stay in touch with our work and everything that's going on in the accountancy world. Sign up now for our latest news and keep one step ahead in your business.

Sign up for our newsletter