Category Archives: GDPR

Read the latest content related to data protection and preparing for GDPR, as well as product and course updates, and helpful guides.

Free on-demand GDPR webinar – conditions for processing

GDPR webinar banner

Under GDPR, you need an approved ‘condition for processing’ for every data processing activity, but you don’t always need to seek consent. With just a week until GDPR comes into force, Director of Course Development Nick Henderson and Director of Best Practice Gary Yantin hosted another webinar to take a deep dive into understanding the conditions for processing data which underpin all uses of personal data.

The webinar covered:

  • When do we need consent and when do we not?
  • How to rely on legitimate interest
  • Data processing scenarios
  • Answering your questions on the topic

Watch now

Continue reading →

Free full-day live webcast: GDPR – one day to go

GDPR webinar banner

Thursday 24 May, 10am – 5pm UK time

In the leadup to the General Data Protection Regulation coming into force on 25 May, VinciWorks has hosted a number of webinars to help businesses prepare for the EU-wide law. To mark one day before GDPR comes into force, VinciWorks will be hosting a full-day live webcast to answer questions, interview experts and review the changes to data protection law under GDPR.

The preliminary schedule includes:

  • Live Q&A with Director of Course Development Nick Henderson
  • Interviews with GDPR experts and leading firms, including Richard Nevinson from the Information Commissioner’s Office
  • Summaries of in-depth GDPR guidance and walkthroughs

By registering you will be able to join the webinar at any point during the day by clicking on the “Join Webinar” button in your confirmation email.

Free registration

Continue reading →

Prepare for GDPR – free on-demand GDPR webinars

GDPR webinar banner

Over the weeks leading up to the General Data Protection Regulation (GDPR) coming into force, VinciWorks has hosted a number of webinars on the topic, answering hundreds of questions in the process. You can get instant access to all our GDPR webinar recordings by clicking on the links below.

GDPR – Data Protection Impact Assessments

During this webinar, Nick guided listeners through the process of conducting a DPIA. He also answered questions on the topic of DPIAs and gave guidance on next steps to those who have already begun the process.

Watch webinar

Continue reading →

On-demand GDPR webinar – Data Protection Impact Assessments (DPIAs)

GDPR webinar banner

With GDPR day less than a month away, Director of Course Development Nick Henderson continued  to help organisations prepare for the new EU wide regulation. During the webinar, Nick guided listeners through the process of conducting a DPIA. He also answered questions on the topic of DPIAs and gave guidance on next steps to those who have already begun the process.

The webinar covered:

  • The seven steps of conducting a DPIA
  • The suggested DPIA timeline
  • What to do if you haven’t yet started conducting your DPIAs
  • Who should be responsible for conducting and monitoring DPIAs
  • Shared tips from attendees

Key findings

  • 55% of attendees said they haven’t consulted externally on their DPIA while 27% said they have and 8% said they haven’t but they should have done
  • Biometric and genetic data are now special categories of data under GDPR and are required to be included in a DPIA
  • It is important to act on the recommendations of the DPIA and often are required to share findings with a third party, such as the Information Commissioner’s Office (ICO)
  • Only 4% of attendees have conducted a DPIA on everything while 30% are planning to begin the process soon

Watch now

Continue reading →

The GDPR resource page

The GDPR resource page

Tens of thousands of businesses have used VinciWorks’ GDPR resources to ensure their policies and training are up-to-date

Is your organisation ready for the EU-wide General Data Protection Regulation which comes into force on 25 May? What still needs to be done to prepare? VinciWorks has created a helpful resource page that containing GDPR compliance tools, course demos, policy templates and more.

The resource page includes:

  • Course demos of all the training included in the GDPR training suite
  • Knowledge checks to test staff’s knowledge of the changes to data protection regulation under GDPR
  • Online guides, including the VinciWorks guide to GDPR
  • Downloadable and editable GDPR related policy templates
  • On-demand GDPR webinars
  • Helpful articles on GDPR compliance

View the GDPR resource page

A brief guide to providing GDPR compliant privacy notices

GDPR banner

Businesses across the EU, large and small, are scrambling to get privacy notices ready for GDPR

A privacy notice tells people from whom you are taking data:

  • Who you are
  • What you are going to do with their information
  • Who you will share it with

At minimum, a privacy notice must contain those three key things. GDPR requires a privacy notice to be concise, transparent, intelligible and easily accessible. It must be written in clear and plain language, appropriate for the audience, and free of charge.

There are three key aspects of good practice to keep in mind when developing a GDPR compliant privacy notice.

Continue reading →

Six conditions for processing data under GDPR

Under GDPR, as well as meeting all of the GDPR principles, an organisation must rely on one of six legal justifications to use personal data, known as the conditions for processing. For instance, you could process a sale to a customer by relying on condition 2, fulfilling a contract.

Different conditions give different rights to individuals. Relying on consent, for instance, gives the person the right to withdraw their consent, a right they must be informed about, usually in a privacy notice.

  1. The person gave explicit consent
  2. It is to fulfil or prepare a contract
  3. There is a legal obligation (excluding a contract)
  4. To save someone’s life or in a medical situation
  5. To carry out a public function
  6. There is some other legitimate interest (excluding public authorities)

If the data is sensitive, i.e. about a person’s race, religion, or health status, there must be an additional justification to process this which can include explicit consent, employment law, or for medical purposes. Under GDPR, genetic and biometric data such as data from a biometric passport or fingerprint scans will now count as sensitive personal data.

Cambridge Analytica – What must Facebook do to become GDPR ready?

Facebook

As Facebook CEO Mark Zuckerberg continues his testimony in Congress following the Cambridge Analytica scandal, he has been set a pile of homework to beef up Facebook’s data protection policies and become GDPR compliant. While the enquiry came about following an investigation into cambridge analytica, in the long run it may have come at the perfect time, with GDPR just weeks away from coming into full force. During the hearing, Zuckerberg committed to implementing GDPR’s standards worldwide.

Eight things Facebook must do to comply with GDPR

Here is what the social network giant must do ensure they are at least on the way to full compliance come 25 May 2018.

1. Appoint a data protection officer (DPO)

Under GDPR, Organisations that process large amounts of personal data, are in the public sector or process particularly sensitive data are required to appoint a DPO. Facebook has certainly recognised this need, advertising the vacant position on their website and other forums. It remains to be seen, however, whether Zuckerberg will seek to appoint a DPO, or someone in a similar role, to strengthen their data protection compliance across the US.

Continue reading →

What is a Data Protection Impact Assessment and how do you conduct one?

Data Protection Impact Assessment cubes

Data protection impact assessments (DPIAs) help organisations identify, assess and mitigate or minimise privacy risks with data processing activities. They’re particularly relevant when a new data processing process, system or technology is being introduced. A DPIA should be managed by the data controller, or data protection officer (DPO) if you have appointed one. Some organisations may consider appointing someone externally to conduct the project.

DPIAs contain a detailed description of the processing operations, an assessment of risks, and what controls need to be put in place to protect people’s information. DPIA’s must be carried out using new technologies or if there is a high risk. It’s also good practice to conduct them on any large scale data processing you carry out. A DPIA needs to contain a detailed description of the processing operations, an assessment of the necessity and proportionality of the processing in relation to the purpose, an assessment of risks to individuals, and what controls are put in place to mitigate any risks.

Read more: on-demand DPIA webinar

High risk data processing

Under GDPR, organisations must undertake a DPIA when processing risky or large scale data. High risk data processing includes systematic and extensive processing activities, large scale processing, processing of special categories (sensitive) data, including those related to criminal convictions, and systematic monitoring of public areas such as CCTV.

Continue reading →