South: Tips from Blandy & Blandy on new data protection regime

The European Parliament has finally adopted the data-protection reform package, including the General Data Protection Regulation (GDPR) which will replace the EU Data Protection Directive on which the UK’s Data Protection Act 1998 is based. The next steps are the translation into the EU’s official languages and publication in the official journal, so it looks as though the official compliance date will be summer 2018.

Debbie Brett, a partner in the commercial and regulatory team at Reading-based Blandy & Blandy LLP, explained: “The ICO has recently published a 12-step checklist for organisations to prepare for the changes. The current ICO advice for organisations is not to delay preparing for the changes until after the Brexit vote, as even with a leave vote there would be a lengthy lead-in time to the formal exit process and in the meantime organisations would still need to be able to deal digitally with the rest of the EU.”  

She continued: “Compliance with the existing data protection regime will meet many of the new regime’s requirements but the increase in potential fines for breaches of the GDPR means organisations would be rash to rely solely on the fact that they comply with the current regime without considering the new aspects being introduced. For example, most organisations will be very familiar with the subject-access regime under the current data-protection regime but the GDPR will, amongst other things, introduce additional rights regarding the prevention of profiling and data portability, and will reduce the time limits for responding to one month instead of 40 days.”