"Do I need a tickbox for GDPR?" is one of the most common questions we get asked in our Membership - Your GDPR Advisor. Unfortunately, it is not a simple yes or no answer. It very much depends on what you think you need a tickbox for. The purpose of a tickbox is so that you can get consent for something, but a tickbox isn't always necessary. For example, a newsletter subscription form does [...]
GDPR for Memberships We work with a lot of membership organisations and they have some unique challenges around GDPR, from those which are based internationally and how to manage the data of UK and EU individuals as opposed to the rest of the world members to those organisations which are linked to a professional body. Some of the challenges faced by memberships are: Contact preferences - This is especially difficult to assign contact preferences [...]
GDPR for Small Businesses: What You Need to Know As a small business owner, you will have heard about the General Data Protection Regulation (GDPR) but perhaps you aren't quite sure what it means for your company. The GDPR is a set of data protection rules designed to give individuals more control over their personal information and ensure that organisations handle that information responsibly. While the GDPR was introduced in the European Union, it [...]
When an individual makes a Subject Access Request (SAR), they are entitled to receive a copy of the information held about them, this will include CCTV footage where this is being captured. A sport centre approached us for advice recently regarding a SAR specifically asking for CCTV footage of an incident on the sports centre's premises. There are always challenges with providing CCTV footage as part of a SAR. Firstly how do you know [...]
Creating Effective Policy Documents Having well-written and easy-to-follow policies is crucial for ensuring consistency and compliance within an organisation. However knowing what the format should look like can be a challenge and getting it wrong means lots of changes. We've written hundred of policies for clients and so I am going to share our format for creating easy to understand and follow policies. Here's the structure we use for creating effective policy documents: Front [...]
Navigating Charities, Cyber Incidents, and Best Practices For charitable organisations, the aim to make a positive impact on society often takes centre stage and the majority of resources. However, amidst the endeavors of charities lies a growing concern—cyber incidents. A statistic produced by the UK government this week shows that 66% of charities, with income over £500k, have suffered a cyber incident in the last year. The digital landscape presents both opportunities for outreach [...]
As a business owner, you're well aware of the importance of GDPR compliance and information security. However, maintaining awareness among your staff can be a challenge. It needs to be something that is memorable, educational, cost effective and engaging, not a short list! I have set out below some different activities you could try to help raise awareness effectively. 1. Regular Training Sessions One of the most effective ways to instill good data protection [...]
As a small business owner, you may be juggling multiple hats and responsibilities. Among these, ensuring the security and integrity of your business's data, especially under the General Data Protection Regulation (GDPR), is crucial. Ongoing awareness activities support increased knowledge and reduce the risk of data breaches and can not only enhance your business's data protection practices but provide a host of additional benefits too. 1. Ensuring Compliance with GDPR GDPR compliance is not [...]
How Do I Know my Small Business is GDPR Compliant? All small businesses collect personal information as part of operating. This may be customers information, suppliers, staff etc so as a result you need to comply with data protection legislation. Failure to do so can have significant consequences including loss of reputation, loss of income and if there is a serious non-compliance issue, a significant fine. Here are some of the things your small [...]
"How long should I keep staff records?" is a frequent question we get asked. The answer is not straightforward as you have to consider current staff and previous staff and the type of records that are being maintained. Data Protection Legislation, including GDPR, sets out that you should not retain information for longer than necessary but you also need to consider the prospect of a legal or insurance claim and therefore retain the documents [...]
Bring Your Own Device (BYOD) is a popular policy where employees use personal devices for work. This typically means using personal smartphones or laptops to access company systems and data. While convenient, BYOD introduces cybersecurity risks that organisations must address. Failure to secure personal devices puts sensitive company information at risk. When employees access internal systems on insecure devices outside the corporate network, businesses lose control of that data. Without proper BYOD policies and [...]
In discussions about information security and data protection, the notion of password protection often arises as a perceived safeguard. However, the efficiency of this method hinges on the nature and complexity of the password being used and the sensitivity of the information being protected. Distinguishing between encryption and password protection is crucial. Imagine your data as valuables stored within a secure box. Password protection means locking this box with a password; the password is [...]
Sending an email to the wrong person is one of the most common data breaches. It’s also usually down to human error, usually because someone is time pressured or trying to do more than one thing at once or not familiar with the software. This happened to one of my clients the other day, they rang me to say they had sent a report about one of their clients to one of their other [...]
"What is the difference between GDPR and Data Protection?" is a questions I asked the other day. It can be very confusing as we use the term GDPR regularly to describe a piece a legislation we need to adhere to. GDPR stands for the General Data Protection Regulation. It’s the European wide legislation brought in in 2018, that created a tsunami of changes to the way businesses collect, store and destroy personal information. In [...]
Procurement, due diligence or security questionnaires, whatever you want to call them are becoming far more common and businesses we work with, who haven't had them before, are starting to get them. We work quite widely in the security sector and they have started getting them from other companies that they work with. Generally, the questionnaires are based on the International Standard ISO27001. The questions can be phrased strangely and be difficult to understand [...]
Let me tell you about a recent incident with one of our clients. So, they had a bit of a hiccup and this led to a data breach. But it was a small data breach, with one person’s information incorrectly shared with another individual. Apparently, someone accidentally emailed the information to the wrong person. A common mistake. But when we sat down to discuss what had happened, they were ready to overhaul their entire [...]
Usually we work with companies, but occasionally an individual will contact us asking for advice. This happened last week when an individual wanted to know if the company they were working for could send the daily emails about absences. The emails look something like this: Absences Email As you can see it shows who is absent and why. These emails are produced daily so could give a history of absences. Also is it appropriate [...]
Special category data is personal information that needs more protection because it is considered sensitive under data protection legislation. There are nine special categories of personal information. They are information that relates to: - race, racial and ethnic origin; - political opinions; - religious or philosophical beliefs; - trade union membership; - genetic data; - biometric data such as fingerprints, eye scanners, but only where it's being used for identification purposes; - health information; [...]
What is your password policy and is it effective? Frequent password changes are one of the things many organisations advocate and actively manage by expiring a password so that it has to be replaced. We are helping a client obtain Cyber Essentials Certification and have been looking at the National Cyber Security Centre (NCSC) website, which has a different viewpoint on passwords. Password changes are designed to limit the harm that comes from an [...]
Two days before Christmas we had a call to the helpline about a Subject Access Request. A company had received a request and the requestor had said that they had 14 days to respond and provide the information. Obviously with all the Christmas and New Year bank holidays, the company were panicking about responding within 14 days. Firstly, the response time for a subject access request is one calendar month. The person making the [...]