Sally Mewies: So welcome to the final video in our series of GDPR Compliancy Check Lists.
We have looked at all the different things that you should be doing through 2017 in order to get your business ready for the launch date on 25 May 2018.
We're now in 2018 and it's our final video so what we thought we would do in this one is just a recap
of the things that you should have done and just the final check list before we go live in May.
So Rocio, we have talked about all the different aspects of GDPR, the challenges, the new parts, the DPO appointments.
We've talked quite a bit as well about notices, privacy notices, and all the documentation.
What should you be doing now in terms of final run in to May?
Rocio De La Cruz: Well one important thing is that perhaps you might have been doing from time to time
during all this time but definitely if you haven't, it's something to do now
is look for legal updates whether or not the members states implemented some derogation's to,
for example, some conditions for processing sensitive personal data, or special category of personal data,
looking for further guidance issued by the Article 29 working party.
So during 2017 we have been told that the Article 29 working party is going to issue further guidance
with regards to the Lead supervisory authority, consent, fair process for processing, risk assessments process for processing,
risk assessments, privacy impact assessments and other issues that will need to be considered
for example code of conduct, certifications, transfer of data for the transfer of data out of the EEA.
And another thing, once you have got all the documents and now you test all these documents
and you understand and they are suitable and they work
then it's time to think about training all the staff for them to use that policies
and for them to be aware of all the requirements, the new requirements under the GDPR.
So it's time for drafting or updating or the e-learning models that you use
or other training samples that you can use and rolling out, so it's time to go live, it's time to roll out.
Sally: And you mentioned derogation's Rocio, I think it's just work pausing on that point isn't it,
because there is ability even though in the GDPR it's intended to be uniform across all of the European countries
and the reason for that of course is that there have been challenges with everybody implementing
the original Data Protection directives slightly differently, so the idea about this is uniform and consistent.
But of course there is acknowledgement in the legislation that there may be some exceptions or derogation's by individual member states.
Can you just tell us where we might expect to see those derogation's
so that people can be on the lookout for them in case they do impact what they're doing in their business?
Rocio: Yes, there might be some derogation's on the transfer of data,
there might be some derogation's on the information that you need to disclose to individuals
if they request for information depending on, for example, matters of national security
or if it is important for legal claims or for employment issues.
There might be some additional conditions in order to possess special categories of personal data so, many bits.
Sally: Yeah, so it's definitely worth keeping an eye on that because that may mean that you have to update policies look again at how you're doing things in certain areas.
Rocio: Yes, that's correct.
Sally: And as you say, get training, get the policies rolled out and you're ready to go.
Rocio: Yes
Sally: So that completes our GDPR Compliance Check List, we hope you've found it useful and good luck.