Data protection day in UK is an opportunity to review strategies and processes involved in collection and use of personal information.
A recent survey by the Information Commissioner’s Office (ICO) showed that 91 per cent of people are concerned about data protection and worry about having their personal information sold to other companies without their consent. 87 per cent worry about a company losing their personal information, showing that good data protection practices can project positively on a company’s reputation.
Data protection law generally applies to all workplaces, business ventures, enterprises, societies, groups and clubs. That includes sole traders, the self-employed and company owners and directors.
“Data protection compliance is not a barrier to business success,” said Paul Arnold, chief operating officer, ICO. “Data can be an incredibly valuable asset when held and processed responsibly and can enable business owners to develop their business, whilst instilling a real sense of confidence in their customers. We live in a data-driven world and if used in the right way, data can really help a business achieve greater success.”
The ICO offers a range of frameworks and advice to ensure compliance with data protection laws, beginning with these basic steps:
Make a list. Start off by making a list of what personal information you have or plan to collect. You need to be able to account for all of it.
Ask why you need the information. There’s a balance to be made between what you want to do with people’s personal information, the benefits that brings to them and any harm that might be caused as a result. If you’re holding or using people’s personal information, it must always be fair as well as lawful.
Think security. Check your security measures line up with the sensitivity of the information you hold. Put stronger data protection security measures in place if the data poses a higher risk or is sensitive.
Be transparent. It’s essential to explain to people why you hold information about them; what you’ll do with it; and how long you’ll keep it before safely disposing of it. This should also be recorded in a privacy notice.
Know about subject access requests. People have the legal right to know what personal information you hold about them. Use our step-by-step guide on how to deal with a subject access request.
Have a data breach action plan in place. If you lose personal information and it is likely to result in a risk to the people affected, you’ll need to report to us. Check out our guide on how to respond to a personal information breach so you know what steps to take in an emergency.
The ICO’s advice for businesses comes as the regulator completes a pilot programme with up to 60 SMEs from across the UK, in which they have been testing a new training and development programme. Called SME Data Essentials, it is aimed at empowering organisations to become better equipped to manage their own data compliance.
The pilot forms part of ICO25, the ICO’s new three-year strategic plan which details how the ICO will bring down the cost of compliance whilst enabling and supporting SMEs to invest, innovate and grow. The ICO has a dedicated SME hub for sole traders, SMEs, charities, clubs and organisations who have queries about data protection, electronic marketing and freedom of information.
