{"id":4246,"date":"2018-04-17T10:00:30","date_gmt":"2018-04-17T09:00:30","guid":{"rendered":"https:\/\/www.sage.com\/en-gb\/blog\/?p=4246"},"modified":"2026-01-29T10:38:56","modified_gmt":"2026-01-29T10:38:56","slug":"gdpr-educate-your-business","status":"publish","type":"post","link":"https:\/\/www.sage.com\/en-gb\/blog\/gdpr-educate-your-business\/","title":{"rendered":"GDPR: How to educate your business and what it means for employee data"},"content":{"rendered":"
\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\tStrategy, Legal & Operations<\/a>\t\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t
\n\t\t\t\t\t

\n\t\t\t\t\t\tGDPR: How to educate your business and what it means for employee data\t\t\t\t\t<\/h1>\n\t\t\t\t<\/div>\n\n\t\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\t\t\t\t\t\t<\/p>\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t<\/div>\n\t\t

\n\t\t
\n\t\t\t
\n\t
\n\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\n\t\t
\n\t\t\t\n\t\t\t\t\"\"\t\t\t\tSara Nelson<\/span>\n\t\t\t<\/a>\n\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t<\/div>\n<\/div>\n\n\n\n

The General Data Protection Regulation (GDPR), the most important change in data privacy regulation in 20 years, comes into effect on 25 May 2018. It\u2019s a complex piece of legislation requiring comprehensive coordination on the part of businesses to educate their workforce and prepare for compliance.<\/p>\n\n\n\n

However, too often the guidance around the GDPR<\/a> is of the academic variety, focusing on “what” the legislation is rather than “how” businesses can become and remain compliant<\/a>. This article focuses on the “how”, detailing concrete steps to educate your business and complete tasks needed to comply with the GDPR.<\/p>\n\n\n\n

Determine accountability<\/strong><\/h2>\n\n\n\n

The UK Information Commissioner\u2019s Office<\/a> (ICO) recommends you nominate someone in your company as the go-to person for the GDPR. As a first step to compliance, look at your business and determine who should fill this role.<\/p>\n\n\n\n

The GDPR outlines very specific actors involved in data protection<\/a>. This includes the data controller \u2013 the person or organisation that makes the decision to capture and use personal data; the data processor \u2013 the person or organisation such as a payroll bureau who is following the instructions of the data controller; and the data subject \u2013 the person whose data is being collected.<\/p>\n\n\n\n

Understanding the obligations of the business in relation to these three actors is a key component of the role of the GDPR champion within your organisation.<\/p>\n\n\n\n

Learn the basics<\/strong><\/h2>\n\n\n\n

The first step to educate your business, according to Ian McDonald, regional instructional designer at Sage, is for business owners to learn the basics.<\/p>\n\n\n\n

While most people who attend GDPR webinars<\/a> know that it is just around the corner, the majority haven\u2019t yet grasped what it means for their business or what steps they need to take.<\/p>\n\n\n\n

Therefore, the priority has got to be education first. This has to be customised to specific groups within your organisation depending on their role and especially include people who deal with personal data on a daily basis.<\/p>\n\n\n\n

\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t

The guide to people and payroll<\/h2>\n\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t

Want to motivate your employees, manage the run-up to payday and improve your payroll processes? Get you free guide and use it to get your people and payroll processes working effectively.<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tGet your free guide<\/a>\n\t\t\t\t\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t\"The\t\t\t<\/div>\n<\/div>\n\n\n\n

Conduct a data audit<\/strong><\/h2>\n\n\n\n

Next, conduct a data audit so each department knows exactly what personal data they hold, what they use it for, with whom they share it and where they store it.<\/p>\n\n\n\n

Adam Prince, vice president of product management at Sage, defines personal data as \u201canything that could identify an individual, so it\u2019s not necessarily the name \u2013 it could be a phone number, an email address, a social media handle or even an internal identity\u201d.<\/p>\n\n\n\n

For GDPR and payroll<\/a>, this will mainly be information about employees, and the good news here, according to Sage product management lead Ceara Metcalf, a specialist in payroll, is that it\u2019s generally quite defined.<\/p>\n\n\n\n

She says: \u201cIn order to pay somebody, HMRC requires you to have specific pieces of information about a person, such as their name, their address, their National Insurance number and their date of birth. As there\u2019s a legal reason to have this information, you don\u2019t need to get consent from the employee, so that makes things slightly easier from a payroll point of view.\u201d<\/p>\n\n\n\n

For other departments such as HR<\/a>, data may be more fragmented across systems and possibly requiring consent, especially where the processing falls outside the usual employer\/employee relationship. The best advice is to consolidate as much data as possible, ideally into an online system.<\/p>\n\n\n\n

A key principle of the GDPR<\/a> is that companies mustn\u2019t hold data on anybody for longer than necessary. Now once the audit is complete, the next task is determining what you must delete.<\/p>\n\n\n\n

From a payroll perspective, HMRC requires companies to keep employee information for a minimum of three payroll tax years. After that, there is no longer a legal basis to keep it and it will need to be removed unless there are other reasons to retain it (for example ongoing legal action).<\/p>\n\n\n\n

Review policies and contracts<\/strong><\/h2>\n\n\n\n

Next, it is worthwhile to review your staff policies around data. This may result in the need to create or update some new policies such as a Data Breach Incident Plan or Human Resources Data Protection Policy.<\/p>\n\n\n\n

Following this, review and update your legal terms and conditions that go into contracts. It is best to make sure, going forward, that your contracts with suppliers and vendors have all the GDPR processing obligations, which are set out in Article 28, in place.<\/p>\n\n\n\n

Educate your business – final thoughts<\/strong><\/h2>\n\n\n\n

These steps will enable your business to begin the process of becoming GDPR-ready. A natural by-product of this approach is that through education at all levels of the business, GDPR compliance is fundamentally embedded throughout your organisation from awareness and education to personal data management, policy development and contract management.<\/p>\n\n\n\n

Even with this positive start, no organisation can become complacent. However, as according to Pat Larkin of Ward Solutions: \u201cA GDPR compliance programme is a significant undertaking for any organisation. It\u2019s also time critical \u2013 ie, you need to be significantly compliant by a prescribed timeline and maintain it ongoing thereafter.\u201d<\/p>\n\n\n\n

In terms of approaching the GDPR, for Adam Prince, compliance essentially comes down to consideration. He says: \u201cConsider the individual rather than you or the organisation when you\u2019re trying to work out if you\u2019re doing the right thing.\u201d<\/p>\n\n\n\n

What steps are you taking to educate your business? Let us know in the comments below.<\/p>\n\n\n\n

\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t

Implementing GDPR: Lessons learned from UK businesses<\/h2>\n\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t

Want to get more insights from businesses on the GDPR? Download this guide, read the stories of the business owners and get up to speed today.<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tGet your guide<\/a>\n\t\t\t\t\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t\"\"\t\t\t<\/div>\n<\/div>\n\n\n

\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t

Subscribe to the Sage Advice newsletter<\/h2>\n\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t

Join more than 500,000 UK readers and get the best business admin strategies and tactics, as well as actionable advice to help your company thrive, in your inbox every month.<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tSubscribe now<\/a>\n\t\t\t\t\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t\"\"\t\t\t<\/div>\n<\/div>\n\n

\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t

Browse more topics from this article<\/h3>\n\t\t\t<\/div>\n\t\t\t
\n\t\t\t\t