What is GDPR?

GDPR – General Data Protection Regulation – came into force in May 2018, underpinned by new legislation in the form of the Data Protection Act 2018, which replaced the 1998 legislation.

The GDPR has been brought in to ensure that personal information is safeguarded. This means companies and organisations have had to review their processes to ensure that information is kept securely and to ensure that it is not kept for longer than legally required.

What is personal data?

Personal data is any information relating to a person which makes them identifiable; whether directly or indirectly, within the EU.

This information could be the individuals name, date of birth or address, or it could be more complex like an IP address.

What do you need to know?

Right to be informed

Your customers have the right to be informed about how you are using their data. You should be only processing their personal data in a lawful, fair and transparent nature.

Right of access

Every individual has the right to request and access all personal information held relating to them by any business or company. This should be provided to the individual free of charge and within one month of the request.

Right to rectification

Individuals have the right to have any personal data rectified if it is inaccurate. This also spreads to third parties if information has been shared, it is the original companies responsibility to inform the other parties of the rectification.

Right to Erase

GDPR states that individuals each have the right to block the processing of any data relating to them.

Right to data portability

This gives individuals the right to obtain personal data from the company and reuse it for their own purposes.

Right to object

Individuals have the right to object to organisations processing and using their personal data, and this can be done at any time. However, the company may not need to grant this request if they are able to provide legitimate reasons as to why they still require to use the data.