{"id":4292,"date":"2018-05-30T09:00:44","date_gmt":"2018-05-30T08:00:44","guid":{"rendered":"https:\/\/www.sage.com\/en-gb\/blog\/?p=4292"},"modified":"2024-01-15T14:42:28","modified_gmt":"2024-01-15T14:42:28","slug":"workplace-activities-gdpr","status":"publish","type":"post","link":"https:\/\/www.sage.com\/en-gb\/blog\/workplace-activities-gdpr\/","title":{"rendered":"10 everyday workplace activities that totally changed under the GDPR"},"content":{"rendered":"
\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\tStrategy, Legal & Operations<\/a>\t\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t
\n\t\t\t\t\t

\n\t\t\t\t\t\t10 everyday workplace activities that totally changed under the GDPR\t\t\t\t\t<\/h1>\n\t\t\t\t<\/div>\n\n\t\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\t\t\t\t\t\t<\/p>\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t<\/div>\n\t\t

\n\t\t
\n\t\t\tPublished
\n\t
\n\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\n\t\t
\n\t\t\t\n\t\t\t\t\"\"\t\t\t\tKeir Thomas-Bryant<\/span>\n\t\t\t<\/a>\n\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t<\/div>\n<\/div>\n\n\n\n

On 25 May 2018, the General Data Protection Regulation<\/a> (GDPR) came into effect across the European Union, regulating how businesses should handle personal data.<\/p>\n\n\n\n

However, research in March from industry analysts IDC found that fewer than half of European small and medium businesses had taken steps to get ready for the new regulations. So we have identified 10 everyday workplace activities that ought to be considered more carefully now the GDPR<\/a> is a reality.<\/p>\n\n\n\n

\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t

Ambition In Action <\/h2>\n\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t

Want to grow your business but struggling to do so? Download this free e-book for advice from Peter Jones and the winner and finalists of the Sage Ambition competition who faced challenges and overcame them using their business ambition.<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tGet your free e-book<\/a>\n\t\t\t\t\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t\"\"\t\t\t<\/div>\n<\/div>\n\n\n\n\n

1. Celebrating a colleague\u2019s birthday<\/strong><\/h2>\n\n\n\n

An individual\u2019s date of birth is their own personal data. Under the GDPR<\/a>, unless shared in a purely personal or household activity, it should not be shared without express consent by the individual. So it is worth checking that you have everyone\u2019s permission to host a shared calendar of birthdays in the office.<\/p>\n\n\n\n

2. Sending office Christmas cards <\/strong><\/h2>\n\n\n\n

If you were planning to send Christmas cards to your customers, stop right there. If that were to include someone\u2019s home address then that is personal data<\/a> so once again not necessarily permissible under the GDPR<\/a>, unless you have consent of the individuals in advance.<\/p>\n\n\n\n

If you do not have express consent to contact each customer, a different legitimate basis must be established for each business communication you send.<\/p>\n\n\n\n

3. Sharing a colleague\u2019s baby photos<\/strong><\/h2>\n\n\n\n

Think twice before sharing baby photos with international colleagues. All those adorable new arrivals may have to remain unseen by colleagues far away.<\/p>\n\n\n\n

Personal data can only be transferred internationally if the country has been designated by the EU as providing an adequate level of data protection or by complying with an approved certification mechanism such as the EU-US Privacy Shield or by obtaining the consent of the individual concerned.<\/p>\n\n\n\n

Of course, if the sharing of a baby photo is deemed a purely personal or household activity, then it can be argued to fall outside of the scope of the GDPR.<\/p>\n\n\n\n

4. Catering for allergies at work events<\/strong><\/h2>\n\n\n\n

Do you have colleagues with nut allergies? Or perhaps they have kosher or halal dietary requirements? Afraid these are all classed as personal data.<\/p>\n\n\n\n

So before you pick up the phone to a restaurant or caterer, make sure you have your colleagues’ permission to share that information with others.<\/p>\n\n\n\n

5. Forwarding on a candidate\u2019s CV for a second opinion<\/strong><\/h2>\n\n\n\n

Not sure about a potential candidate for a role in your organisation? Tough luck \u2013 once again, that will be personal data and cannot be shared with another colleague unless the sharing of their CV is with someone relevant to that role.<\/p>\n\n\n\n

However, an easy way to get a second view of a CV is to anonymise it, removing name, address, phone number and any other identifiable information.<\/p>\n\n\n\n

This is also becoming a growing trend among businesses as a part of an approach to remove gender and race bias in recruitment.<\/p>\n\n\n\n

6. Ticking the box to join a mailing list<\/strong><\/h2>\n\n\n\n

Does your website registration form have a pre-ticked box for customers to receive marketing information from third parties?<\/a> You might want to rethink that now.<\/p>\n\n\n\n

Under the GDPR, silence, pre-ticked boxes and inactivity no longer suffice as consent. You may also want to read through your privacy terms online, as a request by a business for consent to use personal information must be intelligible and in clear, plain language.<\/p>\n\n\n\n

<\/p>\n\n\n\n

7. Talking politics in the office<\/strong><\/h2>\n\n\n\n

Political opinions are part of a special category of personal information \u2013 sensitive personal data \u2013 and organisations cannot record or process data about this type of information unless it is absolutely necessary or they have obtained the explicit consent of the individual concerned.<\/p>\n\n\n\n

So, that email chain about the forthcoming elections starts to look very dangerous, and should anyone forward on that email chain containing people\u2019s political opinions, that may fall foul of the GDPR.<\/p>\n\n\n\n

8. Calling in sick<\/strong><\/h2>\n\n\n\n

Health information is also part of that special category of personal information.<\/p>\n\n\n\n

So, if you have to call in sick one morning because of a specified medical condition, then only the fact that you are unwell should be conveyed to others who need to know your whereabouts, rather than specifying the medical condition.<\/p>\n\n\n\n

9. Data auditing<\/strong><\/h2>\n\n\n\n

Under the GDPR, an organisation needs to have a designated person responsible for data protection matters and in some cases, a company may need to formally appoint a Data Protection Officer<\/a> before carrying out any large-scale processing personal data.<\/p>\n\n\n\n

An individual appointed would be responsible for raising awareness of data protection regulations in an organisation, training staff and managing audits of data processes.<\/p>\n\n\n\n

10. Managing a data breach<\/strong><\/h2>\n\n\n\n

If your business suffers a data hack, you\u2019ve got to think quickly about telling people about it. Under the GDPR, if personal data is accidentally or unlawfully lost, destroyed, altered or damaged, it needs to be reported to the supervisory authority within three days.<\/p>\n\n\n\n

And it\u2019s not just the relevant authority that needs to be notified \u2013 all individuals impacted need to be informed too if it is likely to result in a high risk leading to financial loss, identity theft or fraud.<\/p>\n\n\n\n

\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t

GDPR: A Guide For Small Businesses <\/h2>\n\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t

Want to get more insights from businesses on the GDPR? Download this guide, read the stories of the business owners and get up to speed today.<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tGet your guide<\/a>\n\t\t\t\t\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t\"\"\t\t\t<\/div>\n<\/div>\n\n\n\n

\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t

Subscribe to the Sage Advice newsletter<\/h2>\n\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t

Join more than 500,000 UK readers and get the best business admin strategies and tactics, as well as actionable advice to help your company thrive, in your inbox every month.<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tSubscribe now<\/a>\n\t\t\t\t\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t\"\"\t\t\t<\/div>\n<\/div>\n\n

\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t

Browse more topics from this article<\/h3>\n\t\t\t<\/div>\n\t\t\t
\n\t\t\t\t