Remember the chaos when GDPR came into force in May 2018? We were all scrambling to get our acts together, making sure everything was squeaky clean on the data protection front. Now, with Brexit and the UK GDPR taking the spotlight off the headlines, it’s easy to think, “Out of sight, out of mind.” But the UK GDPR may not be in the limelight, but it’s definitely still alive and kicking!
So, if you’ve been living under the illusion that data protection is a thing of the past and doesn’t apply to you or your company anymore, think again!
Basic mistakes are being made that can still land you in hot water! I recently had a client with a Subject Access Request (SAR). It should’ve been easy to respond to, but was complicated by several wrong turns by the company.
First off, they thought Sue, the Office Manager, (not her real name, of course!) could handle this stuff, so they handed the SAR over to her. Now, Sue’s an extremely experienced Office Manager, but she’s not a data protection guru. Long story short, she missed sending some requested data and ended up sending out some info that wasn’t even needed – oops!
Now the very unhappy data subject, a disgruntled employee, contacts the ICO to complain. The ICO contacts the company and asks to see the company’s policies. Guess what? Sue had drafted some data protection policies using templates she found online, but they were about as mismatched as socks on a Monday morning. They didn’t cover the basics, especially crucial bits related to SARs.
The End Result? Our client landed themselves an enforcement notice and a not-so-glamorous spot on the ICO’s website.
So, don’t let this be you!
Ready to assess your data protection health score? Book a spot for a FREE one-hour Zoom call, and let’s get your compliance journey back on track!