GDPR Lawyers

Data is information that is stored in a way that it can be retrieved by the user. Data may be held in a system which is operated manually or electronically. Personal data is protected. “Personal data” is information which can be used to identify a living person. Where the identity of an individual is permanently removed, the data ceases to be personal data.

UKGDPR is the UK version of the EU’s General Data Protection Regulations 2016. Since Brexit, UKGDPR has diverged from GDPR which applies in the rest of the European Union. For example, under UKGDPR, personal data cannot be exported out of the UK unless safeguards are in place. By contrast, GDPR allows data to be freely moved from one EU country to another.

Personal data is any information which can be identified as relating to the data subject or which comments on them or their behaviour. So, for example, a postal or email address, date of birth, passport number, etc, or the transcript of a telephone conversation, are all personal date if they can be linked to a named individual.

This is deleting the identity of an individual in the data. This can be replaced with, say, a number, so that the data subject cannot be identified. Only keep personal data when absolutely necessary. In some cases, it is possible to identify the data subject using information which ought to be kept separately.

A SAR is a request made by or on behalf of an individual for information about which they are entitled to ask. A SAR does not have to be in writing. It can be in any form. The Information Commissioner’s Office (ICO) suggests that a post on social media might be a credible SAR. A SAR must be responded to as soon as practicable and within one month, unless the request is complex.

In relation to their personal data, every individual has rights: * to be informed about its use; * of access; * to rectification; * to erasure or to restrict processing; and * not to be subject to automated decision-making. This is a complicated area. There are often claims concerning the lawfulness of retention and processing of data. We can provide advice to help you avoid breaches.

A data breach is the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. If the breach is likely to adversely affect a data subject’s rights and freedoms, the subject must be informed without undue delay. The breach must also be reported to the ICO within 72 hours. We are often the first call the client makes in such circumstances.

All employees should be aware of, and be ready to trigger, systems and controls if a data breach occurs. Adopting a ‘no blame culture’ is key. Businesses should promote a willingness to self-report seemingly trivial incidents to build confidence in those systems and controls. We can help you formulate a plan ready for implementation in case a data breach occurs.