Many businesses see the GDPR and with it, the Data Protection Act 2018, as a bewildering mass of red tape and suffocating regulation. Your organisation will have to wade through all of this before you can get on with business. However, when broken down into its seven principles, it becomes a roadmap for successful data handling. A how-to, rather than a how-not-to that will benefit you and your customers and renew trust on both sides.

The Data Protection Act 2018 seven principles are:

Lawfulness, fairness and transparency
Purpose limitation
Data minimisation
Accuracy
Storage limitation
Integrity and confidentiality
Accountability

They read like a checklist of ways to keep your reputation and avoid problems. Sorting each one will unlock a future where your organisation can use data confidently without fear of a visit from the ICO.

In recent years, with increasingly weary attitudes on both sides, the back-and-forth of data protection has become an almost insurmountable hurdle. Customers have become distrusting and reluctant to hand over data. Meanwhile, businesses complain about a painful obligation they never really understood in the first place.

The EU has intervened via the GDPR before this stalemate becomes irreversible. It’s intended not to make the situation more difficult but to hit reset and offer a more optimistic future. It recognises the lack of trust and clarity that has grown around data protection. It sets out seven clear ways to move past it. Getting the principles right is a short-term investment of money, time and effort that will allow your business to stop worrying about data in the long term.

With the internet of things revolutionising our homes and data portability making consumers’ lives simpler, data is leading the charge. The GDPR is a toolkit for what lies ahead – and getting on top of data protection will free your business to innovate.

1. Lawfulness, fairness and transparency

Is your data processing lawful? While this seems like the GDPR’s million-dollar question – and the one that strikes the most fear into the heart of a business – it’s a relatively simple one and will lay a clear path towards meeting the other principles.

The first thing to establish is that as an EU directive, the GDPR’s approach to law doesn’t necessarily match ours. In the UK, we are used to things being legal unless they’re banned; under EU law, things are only legal if they’re expressly permitted. This difference should inform your approach to data protection. It encourages erring on the side of caution.

There are six valid grounds for lawful data processing – known as the lawful bases – so make sure each and every piece of data you process meets one:

Lawful Bases

Clear consent. While there are clear ways to obtain it, ask yourself if the consent is specific enough. Using existing data for new purposes is dangerous and should be avoided.
Contractual need. Signing up for a gym membership is going to be impossible without contact information or bank details. If you can’t perform the exact service the customer has requested without processing a piece of their data, then you’ve got a lawful basis.
Legal obligation. There’s no way HMRC could process an individual’s tax codes without certain financial information. This basis doesn’t rely directly on consent. Whilst it might only apply to certain companies who fulfil legal obligations by the nature of what they do, it still counts.
Vital interest. This basis won’t be most companies’ first port of call. After all, it only applies when failure to process an individual’s data would endanger their life. If someone collapses in the street, an ambulance crew might need to access their medical records before performing CPR.
Public interest. Local authorities and government bodies might process pieces of data in performing tasks like transport surveys, traffic counts or even investigations. If the task is clearly rooted in law then this basis applies.
Legitimate interest. If your company is undertaking data processing that can be considered a ‘normal’ part of day-to-day business. For example, an audit, there’s no reason why it shouldn’t have a lawful basis. However, any individual can object to this kind of processing.

Understand the lawful bases first

Establish one of these bases before you process any piece of data. Don’t retrofit the basis or change it later. It’s also important to make sure that your lawful processing isn’t unlawful in some other sense, for example, breaching copyright laws.

As far as fairness is concerned, it’s no good having consent and a lawful basis if your data processing isn’t in the individual’s best interests. Don’t just consider how you process their data, but whether you should at all. The GDPR states that processing must not be “misleading, detrimental or unexpected”.

An emphasis on transparency is one of the main elements of the GDPR. This sets it apart from previous regulations like the Data Protection Act 1998. Lifting the bonnet and letting people see inside will future-proof data processing and distance it from what is often perceived as a regrettably, murky past. It’s more important than ever to uphold an individual’s right to be informed. You should be clear, honest and open about what you’re up to, before anyone enters into a data-sharing relationship with you.

Practically speaking, there are three main ways to achieve transparency:

Always make clear the categories of data that you intend to process, and how they will be processed
Spell out the individual’s rights in full as part of your privacy notice
Keep your doors open. Make sure you provide clear contact information so that they can query the use of their data at any time

Be certain that your data processing is lawful, fair and transparent – not lawful, fair or transparent. Fulfilling all three criteria will set you on the right track before even considering the other principles.

2. Purpose limitation

Are you doing what your customers think you’re doing? This consideration doesn’t always come naturally to companies – it’s tempting to think of creative or economical new ways to use the data you’ve got.

Spanish football league La Liga recently got into hot water (and landed itself a €250,000 fine) over its app. The app requested users’ permission to access their microphones and location data – nothing unusual there. However, La Liga officials then decided to use this data to listen in on bars that were showing their games illegally.

Cambridge Analytica’s reported use of seemingly innocuous Facebook quizzes for mass data harvesting is somewhat more sinister. This represents a gaping disconnect between what individuals thought their data was being used for (personality profiling) and the purpose it was actually serving (political targeting).

If you’re using existing data for a new purpose, make sure you’ve met one of the following criteria before processing it:

Clear compatibility with the original purpose. What was the data collected for in the first place, and what impact will a new purpose have on the individual?
Separate and specific consent. You’ve obtained it once already, but this doesn’t mean you don’t have to obtain it again.
Clear basis in law. Is your new process legally required or in the public interest?

The data you already have can’t serve a new purpose merely on the basis of a clever idea. Just because you could, that doesn’t mean that you can.

Purpose limitation demands a change in mindset, but it will help to ensure transparency, fairness and accountability. All of which are good news for your company’s reputation.

3. Data minimisation

Why use a fishing rod when you can throw out a net? This question might be cause for thought on a boat trip, but if you’re taking the same approach to data collection and processing then it’s time for a rethink. Make sure the data you collect is “adequate, relevant and not excessive” by figuring out exactly what you’ll need (and what you won’t) before going any further.

By the time the GDPR came along, major tech companies had already found themselves in trouble for excessive data collection. Many companies of any size can fall foul of over-collection. Therefore, you should ensure you monitor what you are collecting and why. Obtain the bare minimum of data and only do it for an immediate purpose – not because it might come in handy down the line. Of course, downstream purposes like handling audits and complaints aren’t the same as just hanging on for the sake of it. Therefore, these are acceptable.

The data minimisation principle applies not only to data collection but to data sharing. Your purposes might not be the same as those of a third party you share data with. Therefore, do not share anything that might not be relevant.

It’s also important not to underestimate what data you need. Small amounts that are insufficient for purpose should be avoided. So, when putting together any type of form or questionnaire, make sure it fully serves its purpose. Any data that doesn’t, whether too much or too little – shouldn’t be collected at all.

You need to be able to demonstrate data minimisation practices as part of being accountable. It’s advisable to check regularly and delete anything that’s no longer needed.

4. Accuracy

This is a less clear-cut issue than it might seem. You would be right to think it’s often obvious when data is inaccurate, for example when an email is undelivered. However, the question of accuracy comes with a lot of challenges. For many years before the EU GDPR, data processing was similar to the Wild West. All sorts of data, whether correct or not, could be stored to build up a profile, at least half of which was completely inaccurate.

The GDPR does not define “accurate”, but it does define “inaccurate” as “anything incorrect or misleading” and encourages regular monitoring and deletion of inaccurate data. How often you do this should depend on the data’s purpose. There are cases in which it’s not necessary to constantly check. A phone number kept as an emergency contact should always be kept accurate, but an email address once used to send a receipt can reasonably go out of date.

The accuracy principle gets more complicated when it comes to data which might be inaccurate by its nature. For example, records might need to be kept of individuals’ opinions even though these are no longer representative. The Data Protection Act 2018 states that as long as this data is clearly labelled as such, then it is accurate.

It’s important not to make any assumptions about data accuracy. Ask yourself how accurate you need to keep data – and, given its level of accuracy, whether or not you can use it.

5. Storage limitation

It’s too easy to store data. Not so long ago a terabyte was an unfathomably large unit of storage. Today, a smartphone can hold it.

This not only breeds sheer carelessness, but creates a tendency to keep hold of data just in case it proves useful later. It’s a new problem. No one in the not-so-distant past of paper records and filing cabinets would have held onto anything unnecessarily.

The GDPR’s standpoint on storage limitation is that data relating to the past shouldn’t be kept if it doesn’t need to be. An individual should, within reason, be able to escape it.

Storage limitation also raises the question of whether to delete or anonymise data. You should always be able to justify why you are keeping individuals’ data in an identifiable form for any length of time. You should be considering the impact of data retention periods on individuals’ privacy.

Make sure you keep storage limitation under constant review. Monitor not only the data itself, but the retention periods and whether they’re still fit for purpose. The Data protection Act 2018 key test for whether you’re storing data effectively is this. Imagine that somebody asks if you can delete their data. You should always be able to justifiably answer “no”. If the answer is “yes”, why do you have it at all?

6. Integrity and confidentiality

What have your customers consented to, and when did they consent to it? If you can answer these two questions clearly, then you’re well on your way to data integrity. It is as much about meeting the other six principles as it is upholding customer’s rights. Data integrity is one of the main purposes of the GDPR. It’s primary aim is to restore your own confidence in your data.

Who’s accessing your Data?

As far as confidentiality is concerned, there are several big considerations to be made. It’s much more than just keeping hackers out. Ask yourself whether your data is inappropriately accessible. Or, for example, whether it’s only possible to access it when it’s genuinely needed. This is an area where the ICO is very publicly cracking down. However, it is not exclusive to huge corporations and multi-million pound fines. Data confidentiality should run through any company like a stick of rock. No matter the size of your business.

The need to keep data from being accessed when it should applies as much to your employees as to external forces. Nosiness or boredom might not be the most sinister motives, but they are no less serious. In 2018 a GP’s secretary was fined for accessing the medical records of friends, colleagues and family members.

It won’t happen to me…will it?

Never assume that because you run a small company and not a major corporation, hackers aren’t interested in your data. An £80,000 fine was recently imposed on an estate agency under the Data Protection Act 2018 for failing to secure its customers’ data over a two-year period. A fine of that size should be enough to persuade you into extra vigilance. However, the data in question was accessed half a million times!!! Not the normal once or twice. Hackers use indiscriminate software to sniff out any insecure data, no matter where or what it is.

Confidentiality also applies to physical security measures. Are you disposing of paper properly and locking office doors tightly? These may seem obvious, but take the same approach to data security right across your business, online and offline. That way you can avoid being the ICO’s next cautionary tale.

7. Accountability

It’s all very well following the other six principles, but can you prove that you’re doing it? A huge focus on accountability is another new feature. This is not in the GDPR, but from the Data Protection Act 2018. So, it’s important to be accountable both to regulators and to the individuals whose data you’re processing. It will aid transparency and it makes good business sense. This will improve your company’s reputation for honesty and integrity. It will also help protect you from legal action in the event of a breach.

Making sure you’ve got the following in place will help establish a clear track record that proves you’ve done your job:

Internal data protection policies. These need to be specific to each category of data that you’re processing, and reviewed regularly.
Written contracts. These need to be established with any external companies who process data on your behalf. They must understand their and your responsibilities.
Documentation of all policies. Ensure you record any data breaches too, big or small, as certain categories need to be reported to the ICO.
A data protection officer. Whoever you choose will need to perform training, monitoring and frequent audits.
Data protection impact assessments. These identify and minimise risk to individuals, and help to keep a record of all decisions.

Culture

A culture of accountability is the big aim here. Your business should place it at the heart of your company’s data processing policy. Not just one part of it.

Data protection “by design and default” is a phrase used by the GDPR. This is where British Airways ran into trouble. It makes it a particularly daunting thought. However, all it means is making sure you’ve got adequate protection in place across new and existing systems.

Our service breaks down the design and default concept from a list of technical requirements into practical applications. We work to deliver realistic, achievable aims. It will help keep your business in line with regulation, but will give you confidence in your data that will allow you to move forward with peace of mind that you’re doing all you need to. After all, that’s what the GDPR and the Data Protection Act 2018 are all about.

Data Protection Act 2018 – the principles