A brief guide to providing GDPR compliant privacy notices

GDPR banner

Businesses across the EU, large and small, are scrambling to get privacy notices ready for GDPR

A privacy notice tells people from whom you are taking data:

  • Who you are
  • What you are going to do with their information
  • Who you will share it with

At minimum, a privacy notice must contain those three key things. GDPR requires a privacy notice to be concise, transparent, intelligible and easily accessible. It must be written in clear and plain language, appropriate for the audience, and free of charge.

There are three key aspects of good practice to keep in mind when developing a GDPR compliant privacy notice.

Continue reading

Free Guide to Compliance with the General Data Protection Regulation (GDPR)

GDPR is the most significant change to EU data protection law in 20 years. The law will apply to all businesses with customers in the EU, no matter where in the world they are based, and mandates much stricter data protection rules than ever before.

To avoid breaches, including fines of up to 4% of global revenue, companies must start preparing now.

As a companion to our new GDPR and data protection course, we have written a free, practical guide to compliance with GDPR.

Fill out your details below to gain access to the GDPR compliance guide:

Fill out my online form.

Six conditions for processing data under GDPR

Under GDPR, as well as meeting all of the GDPR principles, an organisation must rely on one of six legal justifications to use personal data, known as the conditions for processing. For instance, you could process a sale to a customer by relying on condition 2, fulfilling a contract.

Different conditions give different rights to individuals. Relying on consent, for instance, gives the person the right to withdraw their consent, a right they must be informed about, usually in a privacy notice.

  1. The person gave explicit consent
  2. It is to fulfil or prepare a contract
  3. There is a legal obligation (excluding a contract)
  4. To save someone’s life or in a medical situation
  5. To carry out a public function
  6. There is some other legitimate interest (excluding public authorities)

If the data is sensitive, i.e. about a person’s race, religion, or health status, there must be an additional justification to process this which can include explicit consent, employment law, or for medical purposes. Under GDPR, genetic and biometric data such as data from a biometric passport or fingerprint scans will now count as sensitive personal data.

Cambridge Analytica – What must Facebook do to become GDPR ready?


As Facebook CEO Mark Zuckerberg continues his testimony in Congress following the Cambridge Analytica scandal, he has been set a pile of homework to beef up Facebook’s data protection policies and become GDPR compliant. While the enquiry came about following an investigation into cambridge analytica, in the long run it may have come at the perfect time, with GDPR just weeks away from coming into full force. During the hearing, Zuckerberg committed to implementing GDPR’s standards worldwide.

Eight things Facebook must do to comply with GDPR

Here is what the social network giant must do ensure they are at least on the way to full compliance come 25 May 2018.

1. Appoint a data protection officer (DPO)

Under GDPR, Organisations that process large amounts of personal data, are in the public sector or process particularly sensitive data are required to appoint a DPO. Facebook has certainly recognised this need, advertising the vacant position on their website and other forums. It remains to be seen, however, whether Zuckerberg will seek to appoint a DPO, or someone in a similar role, to strengthen their data protection compliance across the US.

Continue reading

What is a Data Protection Impact Assessment and how do you conduct one?

Data Protection Impact Assessment cubes

Data protection impact assessments (DPIAs) help organisations identify, assess and mitigate or minimise privacy risks with data processing activities. They’re particularly relevant when a new data processing process, system or technology is being introduced. A DPIA should be managed by the data controller, or data protection officer (DPO) if you have appointed one. Some organisations may consider appointing someone externally to conduct the project.

DPIAs contain a detailed description of the processing operations, an assessment of risks, and what controls need to be put in place to protect people’s information. DPIA’s must be carried out using new technologies or if there is a high risk. It’s also good practice to conduct them on any large scale data processing you carry out. A DPIA needs to contain a detailed description of the processing operations, an assessment of the necessity and proportionality of the processing in relation to the purpose, an assessment of risks to individuals, and what controls are put in place to mitigate any risks.

Read more: on-demand DPIA webinar

High risk data processing

Under GDPR, organisations must undertake a DPIA when processing risky or large scale data. High risk data processing includes systematic and extensive processing activities, large scale processing, processing of special categories (sensitive) data, including those related to criminal convictions, and systematic monitoring of public areas such as CCTV.

Continue reading

New Learning Management System version coming soon

We are excited to share that the VinciWorks Learning Management System (LMS) will be upgraded to version 6.0 in the next few months. The new version of the LMS has many improvements that focus on creating a rich user-friendly learning experience. With a beautiful new user interface, learning plans, video course creation and more, this upgrade improves many aspects of the system, without changing any of the current functionality. You can view a video demonstration of the new version by clicking on the image below.

Play lms 6 demo

LMS 6.0 – what’s new?

LMS 6.0 includes hundreds of enhancements to the system architecture, improved user experience and many new features.

Continue reading

The GDPR guide to being a Data Protection Officer

Keyboard with Data Protection Officer key

With GDPR (General Data Protection Regulation) day approaching, the number of vacancies in roles as a Data Protection Officer (DPO) has reportedly increased by over 700% in the last two years. Data protection professionals are finding that their skills and knowledge are suddenly invaluable and in high demand compared to a few years ago. VinciWorks’ guide to being a DPO will give you a clearer idea of what is required from a DPO, helping you appoint the right person for the role. The guide will also help those being promoted to the role of DPO gain an understanding of what is required of them under GDPR.

Free download

Continue reading

How does GDPR affect social media marketing?

Social media screen on a smart phone

Often used as a free marketing tool, and with some staff having thousands of personal followers on social media platforms such as Twitter, Facebook and LinkedIn, social media is becoming an important cog in many companies’ marketing campaigns. Here is some guidance on what GDPR requires of us when using social media for marketing purposes.

Read: The digital marketing guide to GDPR

Who does the legislation apply to?

GDPR does not apply to individuals using social media for their own purposes, but does apply to individuals acting as sole traders or organisations who use social media in the following ways:

  • Posting personal data on a website
  • Downloading and using personal data from a website
  • Running a website which allows others to post comments or other content about people

Continue reading

Compliance update special: The biggest compliance scandals of 2018 so far

This year has already been significant in terms of compliance breaches by some of the world’s largest companies. And it’s not just business who’ve seen major failings recently, as we review recent compliance scandals in this years’ Compliance Update: 1 April Special.

Easter bunny fined for sanctions breaches

The Easter Bunny has been fined a record £21m by the Office of Financial Sanctions

Implementation (OFSI) for illegally importing up to 40 million Easter eggs. The eggs were illegally imported from Never Never Land in violation of international sanctions against the rogue state, with The Easter Bunny allegedly committing serious acts of bribery during the import of the eggs to cover up their origins.

Never Never Land continues to remain under severe international sanctions due to its failure to adhere to data protection laws and the continued WMD programme of dictator Captain Hook. With recent EU legislation expanding the scope of sanctions compliance, all organisations are being reminded to ensure their compliance is up to speed and they are not doing business with designated persons such as Captain Hook.

Free sanctions policy template

Continue reading