Page 221 - Demo

Focus on accountability and transparency
One of the key amendments to the law is in the change in focus to accountability and transparency. What this means in practice, is that organisations have to be able to prove that they comply with the law, and the only way to do this is to ensure that all your records are detailed, and
up to date.
You may also need to think about the way in which you record certain information – such as when someone consents to you having and using their information. It is no longer enough just to comply with the law – you have to be able to prove it as well. Looking at the records that you currently have and where these might be improved, is something that you should be looking at now, to give you time to implement changes needed before May 2018.
Change to de nition of consent
Under the current law, “consent” bears its natural meaning, but under
GDPR, for consent to be valid, it must be speci c, informed, freely given and unambiguous. Whilst this does not necessarily mean that you cannot continue to rely upon implied consent, it is worth looking at when you rely on consent and how you obtain and record that consent, so that you could show, if asked, that you meet those conditions.
Need for privacy impact assessment
Where you are doing something with personal data where there might be
a risk to the individual, you are now required to carry out a “Privacy Impact Assessment” or “PIA”. This is simply a question of balancing the bene ts of what you want to do against the risks to the individual and setting out any steps you are taking to mitigate or lessen those risks. This should be done before you put in place the new, riskier action and needs to be in writing and kept so that you can meet the accountability requirement above.
Legal requirements for policies
Data controllers will have to have a data retention policy in place and a data breach noti cation policy before May 2018. A data retention policy just needs to set out the categories of data that you have and how long you intend to keep them. There is no magic formula to this – some records you will be required to
Chapter 11 217