Data protection Laws are changing over the next year and they will affect you.  Although not effective until May 2018, now is the time to start getting your processes in place.

What Is Data Protection?

As an employer, you process all sorts of data of data on your employees and The Data Protection Act 1998 details the way you process in a lawful way.

What is Data?

‘Data’ is any information that is processed by means of computer (HRIS) or recorded in a relevant filing system (personnel files).

It has 2 further classifications:

Personal Data which is information from which the identity of the individual to whom it relates can be identified

Sensitive data which is data relating to, amongst other things, a person’s race, any disability, sexual orientation, health condition etc.

Your Obligations

You must ensure data is kept accurate and up to date, be processed fairly and not kept for any longer than necessary.

What is Changing?
Some of the main changes affecting employers from May 2018 will be:

• You must obtain explicit consent from employees to processing their data. Reference to consent which is buried within an employee handbook will not be sufficient. Employees must also be informed of their right to withdraw consent.
• If you get a request to access data (where employees request sight of the personal data kept on them) you will no longer be able to charge the employee £10 as standard. Charges may only be applied where the request is excessive.
• You must provide the Information requested as soon as possible and within a month at the most. Currently, a 40 day deadline applies.
• If you breach the data protection laws you may be fined up to 4% of annual global turnover or €20 million.
• You must carry out Data protection risk assessments when you begin a new project or new strategy, for example after organisational change
• Breaches will have to be notified within 72 hours.

What Should You Do Now?

The Information Commissioner – the body which presides over data protection in Great Britain – has issued guidance on how to prepare for the changes. Amongst other things, it suggests you:

• Review the way you currently storing data – are you being compliant now?
• Review the type of data you are keeping – is it necessary to keep all that data?
• Make yourself aware of the changes and the impact they will have.
• Document what personal data you already hold and how you share it.
• Determine where changes will be needed to relevant company documentation.
• Plan how you will need to deal with employee requests for access to data
• Review how consent to processing is obtained.