Tips on Demonstrating UK GDPR Compliance

|
|
PUBLISHED on
22 Jul
2022

The easy way (if it was available!) would be to certify to an approved UK GDPR certification scheme.  The Data Protection Act 2018 gave the UK’s privacy regulator, the Information Commissioner’s Office (ICO), the power to accredit providers of certification schemes for demonstrating compliance with the UK GDPR.  Unfortunately, a widely-applicable certification scheme, applicable to different types and sizes of UK organisations, still does not exist.  In August 2021, the ICO did approve 3 certification schemes, however, these were for quite specific purposes: IT asset disposal, age assurance and age-appropriate design.

Back in 2017/18, we saw many organisations creating a ‘task force’ or project team to address GDPR compliance in the run-up to the May 2018 deadline.  Most of these organisations typically disbanded their taskforce teams once they felt that compliance had been achieved, although some appointed a responsible data protection manager/DPO or compliance officer.  As with other compliance activities, we appreciate how difficult it is to maintain ‘good intentions’ as other business pressures/requirements take centre stage.  Equally, when the GDPR was launched, there was limited guidance available and, with the goalposts now having shifted slightly, some organisations may find that they are not as compliant as they originally thought.

What we do have now, is a British Standard, namely BS 10012, which provides a best practice framework for a personal information management system.   Whilst not an international standard, such as ISO 27001, or a complete model for the UK GDPR compliance, BS 10012 is aligned to the principles of the GDPR and a good starting point. However, this is not a quick (in the next few months type!) solution.

So, what can you do now to demonstrate UK GDPR compliance?  A very practical approach is to arrange an external audit by an experienced GDPR/DP practitioner.  If structured correctly, this will not only verify your compliance status, but will provide you with valuable advice and insight into good practices adopted by other organisations.

A valuable UK GDPR compliance audit is not all about the DP/UK GDPR rules, it’s also about ensuring you are complying with your own policies, processes, and procedures i.e., the measures you put in place to establish UK GDPR compliance in the first place.

Here are some questions which should help you in determining your level of compliance with the GDPR

  • Are you complying with your policies?
  • Have you reviewed consent mechanism?
  • Have you continued to evaluate third parties and their contractual conditions?
  • Have you maintained your register of processing activities?
  • Has your business changed at all and are your lawful grounds for processing still valid?
  • Have you reviewed your data flows in line with any chances?
  • Have you maintained your DPIA records and are you conducting DPIAs as and where required?
  • Do you nave an effective mechanism in place for dealing with subject access requests?

Do you need assistance in improving your GDPR compliance position?

URM can offer a host of consultancy services to improve your DP policies, privacy notices, DPIAs, ROPAs, privacy notices, data retention schedules and training programmes etc.
Thumbnail of the Blog Illustration
Data Protection
Published on
12/4/2024
Data Protection Considerations for Artificial Intelligence (AI)

URM’s blog discusses the data protection considerations for utilising AI technologies, and how organisations can stay GDPR compliant in their use of AI.

Read more
Thumbnail of the Blog Illustration
Data Protection
Published on
6/2/2023
Analysis of Fines Imposed by the Information Commissioner’s Office in 2022

When looking to comply with the General Data Protection Regulation (GDPR), it is always a worthwhile exercise....

Read more
Thumbnail of the Blog Illustration
Data Protection
Published on
22/7/2022
Are you adequately covering GDPR within your ISMS?

We have seen an increased focus on the General Data Protection Regulation (GDPR) by certification body (CB) assessors when conducting ISO 27001 audits.

Read more
We cannot thank URM enough for their help in ensuring our business is GDPR compliant. Both the gap analysis conducted and the in-depth assistance with the ROPA were made much easier and understandable with URM’s help. I would like to give particular thanks to URM's Consultant for providing us with the best guidance and making a famously complex topic comprehensive, and to our Account Manager for helping make sure all our needs were covered.
contact US

Let us help you

Let us help you in your compliance journey by completing the form and letting us know how we can best support you.