Blog - Page 3 of 6 - GDPR Advisors

25 06, 2023

What’s the difference between GDPR and Data Protection?

"What is the difference between GDPR and Data Protection?" is a questions I asked the other day. It can be very confusing as we use the term GDPR regularly to describe a piece a legislation we need to adhere to. GDPR stands for the General Data Protection Regulation. It’s the European wide legislation brought in in 2018, that created a tsunami of changes to the way businesses collect, store and destroy personal information. In [...]

14 02, 2023

What is special category data?

Special category data is personal information that needs more protection because it is considered sensitive under data protection legislation. There are nine special categories of personal information. They are information that relates to: - race, racial and ethnic origin; - political opinions; - religious or philosophical beliefs; - trade union membership; - genetic data; - biometric data such as fingerprints, eye scanners, but only where it's being used for identification purposes; - health information; [...]

17 01, 2023

What is your password policy and is it effective?

What is your password policy and is it effective? Frequent password changes are one of the things many organisations advocate and actively manage by expiring a password so that it has to be replaced. We are helping a client obtain Cyber Essentials Certification and have been looking at the National Cyber Security Centre (NCSC) website, which has a different viewpoint on passwords. Password changes are designed to limit the harm that comes from an [...]

10 01, 2023

How long do you have to respond to a Subject Access Request?

Two days before Christmas we had a call to the helpline about a Subject Access Request. A company had received a request and the requestor had said that they had 14 days to respond and provide the information. Obviously with all the Christmas and New Year bank holidays, the company were panicking about responding within 14 days. Firstly, the response time for a subject access request is one calendar month. The person making the [...]

20 05, 2022

Do I need a Data Protection Officer (DPO) for GDPR?

This short video takes you through when you need a data protection officer (DPO).

16 05, 2022

Legitimate interest as a lawful basis is not an excuse to market to everyone.

This week through the helpline, we had a call from a company who had used legitimate interests to scrape email addresses from the web, and then send them marketing information. They explained that marketing emails were in their interests and the interests of the person emailed so they could place their services and goods on the caller’s platform for sale. There are very specific rules about email marketing both in data Protection legislation and [...]

30 04, 2022

Email Marketing – Do I need a tickbox?

Back to Basics and email marketing. Over the last couple of weeks we've been looking at some email marketing signup forms. And it's quite interesting when an organisation decides to put a tick box, although sometimes it's the software that has a tick box that you cannot remove. When someone is signing up for your email marketing list, you might create a form where someone can insert their email address and there's a tick [...]

18 04, 2022

Are your suppliers protecting your business information?

We find clients don't often think about supplier risk. Currently we're working with a company to implement ISO27001 and as part of that process, we are checking their suppliers for information security standards and GDPR etc. As part of checking suppliers for compliance, we needed a list of the suppliers and this particular company have outsourced their finance function to an accountancy firm. We asked the accountants to provide a list of the suppliers [...]

2 03, 2022

Dealing with special category information related to health

Under data protection legislation, health information is considered a special category of personal information. This means that it needs some additional controls in place to be able to collect and store it. There are a number of special categories and health information is one of the most commonly used because we collect it through various channels within our businesses. Today, we're just going to focus on those companies that collect it because they deal [...]

1 02, 2022

A common email data breach – failing to BCC

A common email data breach by failing to BCC the recipients My son has started a new job and is heading off for a training course on Sunday. As part of attending the training course he was provided with information about the venue and training sessions along with the other new starters. My son could see the personal email addresses of colleagues he’s yet to meet on a company email. As my son (And [...]

26 07, 2021

The UK is adequate for Data Protection Purposes

The UK is adequate. Doesn't sound great does it but it is really good news for continuing to make transfers to and from the EU/EEA. You may remember me telling you at the beginning of the year that there was a 6-month period where transfers to the EU could continue until the UK achieved an adequacy status from the EU. The adequacy status was approved on the 28th June (talking about taking it to [...]

Previous 234 Next