Expert GDPR compliance solutions

The financial penalties for a data breach under GDPR have risen significantly from those under the old Data Protection Act (1998). Fines can now be as much as €20 million/4% of annual global turnover (whichever is greater) for the most serious category of breach. Without GDPR, chances are you won’t have adequate control over data protection and won’t be taking the necessary steps to protect personal data. Plus, with flexible packages and custom implementation plans, Bulletproof GDPR compliance probably costs less than you think.

Personal data is information that relates to a living individual. It means the individual can be identified directly or indirectly by one or more pieces of information that are specific to that individual. Examples of personal data include your name, email address, passport number, an IP address or even location data.

Every business, regardless of size, will handle some form of personal data, whether it is that of staff, customers or suppliers, so the GDPR is applicable and must be adhered to.

First off, GDPR is a law. Like any other laws that apply to your company, the directors have a responsibility to make sure laws are abided by. Equally important is the expectations of your customers, employees, and others who you handle the personal data of. They will, as you would, expect their data to be handled in a safe way, taking into consideration their best interests.

Additionally, as the use of personal data is increasingly in the spotlight because of the ever present and intrusive nature of social media, individuals are becoming much more concerned about the use of their data, making it more likely that they will make conscious decisions about the organisations they use and trust, which could have a direct commercial impact.

Finally, achieving GDPR compliance does not mean you won’t have a data breach, but it does help to reduce your risk and the subsequent repercussions of any such breach e.g. reputational damage, fines, and legal action.

Yes, there is a bit of a myth that companies with fewer than 250 employees do not have to comply with the requirements of the GDPR. This misconception largely comes from the wording of Article 30 which relates to the need to keep a record of processing activities, where there are potentially some exceptions for organisations with fewer than 250 staff. However, apart from this specific article, organisations of any size must meet the requirements.

No, a privacy notice is an essential part of addressing one of the GDPR principles that relates to transparency, but it does not mean you are GDPR compliant. GDPR requirements include the need for your company to address a lot of issues around governance, designing data protection into your projects, keeping records of the personal data you handle, developing policies and procedures around the use of personal data and training, to name a few.

Unfortunately, no, not at this stage. There is currently no UK-based certification scheme for the GDPR. This is currently being looked at by the Information Commissioner. The best way to demonstrate your compliance to potential customers is to have a GDPR audit which will provide your customers with an overview of compliance from a third-party point of view. Bulletproof can assist with this.

GDPR is about policies, procedures, technologies and actions – not software. True GDPR compliance is a holistic approach to data security encompasses the length and breadth of your organisation. You can’t buy compliance as software. That’s not to say that software can’t be helpful. In fact, Bulletproof gives you access to additional tools as part of our GDPR services, which makes managing and maintaining compliance a pain-free experience.