Get staff involved train your staff, get staff involved in what GDPR means to them and to your customers. Our previous videos will give you a head start so start there to begin with.
Choose someone to be a data controller who will oversee data security and requests. In small businesses we might not have the luxury of having a full time data control position.
Write a privacy policy and make sure your staff are familiar with it. We’re good at putting these on our websites but actually an internal privacy policy on information security is really really important train your staff on it. If you want to get some expert advice in as well, there’s lots of stuff online, but it might be well worth having a half-day information security consultant come in and help with your policy.
Run a data audit ask yourself some simple questions,
- Do you know all the ways data comes into your organization systems? From networking, lead generation, websites, however it might come in identify all those different sources that data comes in.
- Do you know exactly where this is all stored? Paper, electronic? If it’s electronic is on your own servers? is it in cloud-based systems? which cloud based system? what happens when that cloud-based system gets backed up does your data stay in the UK does it go elsewhere?
- Then do you know exactly who has access to your data. If you’ve had some levers are you sure that their credentials have been stopped and their access to your system is being revoked?
- Do you share data with third parties? Any companies or partnerships that you’ve got relationships with that you may pass data to and forth, get to grips with with who you’re giving what to – maybe document this and how some processes in place you understand what they’re going to do with the data once you hand it over.
- Can you show how you obtain each contact on your database? What was the source, were they informed, did they opt in? You can store all that data against contact records nowadays so it’s important to make sure you’ve got that in place.
- Review your data retention policy. Why are you keeping data? How long do you keep it for? Can you justify why you’re keeping data for a certain amount of time. We’re very comfortable when we’re doing this with financial data and other personal records, but actually, are we’re doing it for the right types of records for gdpr?
Finally, test your procedures. Run real-world scenarios, how can you be sure that your data protection policies and your compliance is robust until you test it? It’s like backups of your systems, until you restore the backup you don’t know if the backup’s any good or not. So picture yourself as a member of the public asking to see all the data you hold about an individual. Can you turn it around quickly? Picture that you’re member of the public asking for the right to be forgotten? Can you easily erase the information from your data and all of your other sources of data, whilst we’re sending a stub of a record just make sure that you don’t contact that person once again in the future without meaning to? and finally the big one – there’s been a data breach, what do you do? Really go to town on this one, just make sure that if a data breach happens make sure that you’ve got processes in place and they’re tested for how to deal with that scenario.
- Once you’ve got these three important procedures set up create reminders to audit your system, put a recurring calendar appointment in every month, every two months, quarterly, whatever it needs to be for your business