After a two-year implementation period, the General Data Protection Regulation applies from today across the EU. In the UK it is supplemented by the Data Protection Act 2018, which received Royal Assent on 23 May and replaces the Data Protection Act 1998.
Key security obligations
- Article 5(1)(f) and Article 32: appropriate technical and organisational measures, including encryption, pseudonymisation, resilience and regular testing.
- Article 33: notify the ICO of a reportable personal data breach within 72 hours.
- Article 34: notify affected individuals where the risk to them is high.
- Article 28: written contracts with processors, including security requirements.
- Article 35: data protection impact assessments for high-risk processing.
GDPR compliance is a continuing journey, not a one-off project. Keep your records of processing, risk assessments and breach procedures under review and embed them in your management system.
Source: Data Protection Act 2018 (legislation.gov.uk)
This update is general information, not legal advice. If you would like help assessing the impact on your information security or privacy programme, contact us.
