{"id":4266,"date":"2018-04-23T10:00:56","date_gmt":"2018-04-23T09:00:56","guid":{"rendered":"https:\/\/www.sage.com\/en-gb\/blog\/?p=4266"},"modified":"2024-01-15T15:44:12","modified_gmt":"2024-01-15T15:44:12","slug":"personal-data-gdpr","status":"publish","type":"post","link":"https:\/\/www.sage.com\/en-gb\/blog\/personal-data-gdpr\/","title":{"rendered":"GDPR: How your business should deal with personal data"},"content":{"rendered":"
\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\tStrategy, Legal & Operations<\/a>\t\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t
\n\t\t\t\t\t

\n\t\t\t\t\t\tGDPR: How your business should deal with personal data\t\t\t\t\t<\/h1>\n\t\t\t\t<\/div>\n\n\t\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\t\t\t\t\t\t<\/p>\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t<\/div>\n\t\t

\n\t\t
\n\t\t\t
\n\t
\n\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\n\t\t
\n\t\t\t\n\t\t\t\t\"\"\t\t\t\tKeir Thomas-Bryant<\/span>\n\t\t\t<\/a>\n\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t<\/div>\n<\/div>\n\n\n\n

The GDPR<\/a> is a piece of legislation with some tricky technical aspects, so you could be fooled into thinking that it\u2019s only relevant for those who are experts in data privacy.<\/p>\n\n\n\n

Unfortunately, this couldn\u2019t be further from the truth. Protecting personal data is relevant for everybody involved in a business, and for all sizes of business \u2013 from sole traders and charities right up to the biggest corporations.<\/p>\n\n\n\n

Have you ever stopped to think about how much data you deal with every day, maybe even without realising? Article 5(f) of the GDPR<\/a> says the following: \u201c[personal data shall be] processed in a manner that ensures appropriate security.\u201d<\/p>\n\n\n\n

It\u2019s no longer enough to keep your fingers crossed. Let\u2019s take a look at a typical day in the life of a regular employee and, with regard to the above, see just some of where the gotchas for data protection lie. This isn\u2019t an extensive list, of course, and that\u2019s perhaps the most important takeaway here \u2013 data protection is an ongoing process that must be considered every minute of every day.<\/p>\n\n\n\n

\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t

GDPR <\/h2>\n\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t

<\/p>\n

Need help with meeting your GDPR obligations and making sure your businesses processes are working in the correct way? Here's what you need to know.<\/p>\n

<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tFind out more<\/a>\n\t\t\t\t\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t\"Working\t\t\t<\/div>\n<\/div>\n\n\n\n\n

Morning commute: 7am to 9am<\/strong><\/h2>\n\n\n\n

Who hasn\u2019t checked their work email on the morning commute? Some people start to deal with their emails even before climbing out of bed.<\/p>\n\n\n\n

Email is one of the key ways personal data gets into or out of a business. If you\u2019ve even a few emails in your inbox then you\u2019ve amassed a surprising amount of personal data and this is a perfect example of how even businesses that claim to be immune from the GDPR simply aren\u2019t \u2013 and cannot be. It also demonstrates the pervasiveness of personal data within a business.<\/p>\n\n\n\n

Checking email from your phone can present security risks when it comes to hack attacks that represent an obvious data breach potential. If you find yourself with a message within your mobile phone\u2019s email inbox that looks questionable then it might be best to wait until you get to the office before opening it on your desktop computer (assuming it isn\u2019t clearly something that should be deleted, of course).<\/p>\n\n\n\n

Mobile phones simply don\u2019t have the same kind of mature and evolved security measures as desktop computers, which typically have antivirus apps installed along with malware and phishing protection.<\/p>\n\n\n\n

It isn\u2019t just technology that presents data protection challenges<\/a> on the commute. Watch what you\u2019re saying within calls and how loudly you\u2019re speaking. There could be people listening nearby who could overhear any sensitive discussions that may be classified as personal data. Watch out too for nosey parkers, who peer at your screen when you\u2019re sitting next to them.<\/p>\n\n\n\n

<\/video><\/div><\/div><\/p>\n\n\n\n

In the office: 9am to 5pm<\/strong><\/h2>\n\n\n\n

Most office jobs involve handling or transferring personal data in some way, and therefore data protection and the requirements of the GDPR must be considered at all times.<\/p>\n\n\n\n

Let\u2019s say a colleague across the office asks you to pass them some files. These files contain personal data and are too big to email. In many offices, it\u2019s natural to reach for a USB memory stick and pass around data that way. But this opens up a serious security hole.<\/p>\n\n\n\n

There\u2019s nothing wrong with using USB memory sticks as such but you\u2019ll need to ensure the data is encrypted with a password before you transfer. This should mean that if the USB stick is lost or stolen then nobody will be able to access the data on it.<\/p>\n\n\n\n

How about if you\u2019re working with a third-party company and they request you send them some data? In the first instance, you need to question whether there\u2019s a lawful reason for sending the data to the first party. You should also wait until you are positive your business has a contract or signed non-disclosure agreement with them.<\/p>\n\n\n\n

If transferring files to an approved third party, again you must use a secure file transfer solution when sharing sensitive information. And don\u2019t forget that long email chains you might forward could contain data from previous correspondence that again might be considered personal data.<\/p>\n\n\n\n

When working with third parties both you and they will probably have to document your measures to comply with the GDPR as part of the new record-keeping requirements.<\/p>\n\n\n\n

Got old files or reports? Archive or delete them as appropriate if no longer needed (or establish another lawful reason for continuing to process the data). And remember that if you\u2019re using personal data for which consent was given for a particular purpose, you can\u2019t then use it for something else unless you get fresh consent.<\/p>\n\n\n\n

You might need to ensure the data is correctly destroyed \u2013 for example, if you receive a request from an individual for this to happen \u2013 and this can be a challenge in itself. For example, data simply deleted from a computer\u2019s hard disk can stick around in a way that can be recovered.<\/p>\n\n\n\n

The secure delete function of your computer\u2019s operating system might offer a solution but if the data is on removable storage such as a CD\/DVD, or even on a hard disk dedicated to the purpose of transferring data, then you will need to look into secure physical destruction methods.<\/p>\n\n\n\n

\"Lock
Lock your computer when you’re away from your desk so personal data isn’t available for all to see<\/figcaption><\/figure>\n\n\n\n

Heading home: 5pm to 7pm<\/strong><\/h2>\n\n\n\n

Before walking out of the office, be careful not to leave your laptop open or PC screen visible. Remember to lock your system’s screens when leaving them unattended in the office, or shut down fully at the end of the day before heading home.<\/p>\n\n\n\n

Get into the habit of leaving your desk clear every evening, which can involve locking away paperwork that contains personal data. If you don\u2019t need personal papers anymore, shred them or put them in a secure locked shredding bin. Watch out for accidentally leaving any personal papers or computer equipment on cafe tables, train seats, and so on.<\/p>\n\n\n\n

While on the evening commute on the train, or in transit to any location, think twice before connecting to non-secure wi-fi networks. If you\u2019re planning to access personal data, consider using a VPN (Virtual Private Network), which encrypts data even if it is flowing through a potentially unsecured network. This should have its \u201cendpoint\u201d at your business premises to ensure maximum data security.<\/p>\n\n\n\n

More help to protect personal data<\/strong><\/h2>\n\n\n\n

Need more help with the GDPR? Our Sage Business Experts have shared how they prepared for the legislation<\/a> and revealed some tips.<\/p>\n\n\n\n

Take a look at this GDPR guide for small businesses<\/a>. And here are the answers to 12 questions you might have about the legislation<\/a>.<\/p>\n\n\n\n

\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t

GDPR: A Guide For Small Businesses <\/h2>\n\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t

Want to get more insights from businesses on the GDPR? Download this guide, read the stories of the business owners and get up to speed today.<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tGet your guide<\/a>\n\t\t\t\t\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t\"\"\t\t\t<\/div>\n<\/div>\n\n\n\n

\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t

Subscribe to the Sage Advice newsletter<\/h2>\n\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t

Join more than 500,000 UK readers and get the best business admin strategies and tactics, as well as actionable advice to help your company thrive, in your inbox every month.<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tSubscribe now<\/a>\n\t\t\t\t\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t\"\"\t\t\t<\/div>\n<\/div>\n\n

\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t

Browse more topics from this article<\/h3>\n\t\t\t<\/div>\n\t\t\t
\n\t\t\t\t