GDPR Registers

Under GDPR, an individual's personal data always belongs to them and any organization using their data must keep the individual fully informed and respect the individual's right to retain control over it.

To use people's information, also known as processing personal data, an organization must comply with each of these six GDPR principles.

1. Lawful, fair and transparent—There has to be legitimate grounds for collecting the data and it must be used in a way that a person would reasonably expect.
2. Limited for its purpose—Data should be collected for specified and explicit purposes and not used in a way someone wouldn't expect or in a manner inconsistent with that purpose.
3. Adequate and necessary—Unnecessary data or information without any purpose should not be collected.
4. Accurate—Reasonable steps must be taken to keep the information up to date and to change it if it is inaccurate.
5. Not kept longer than needed—Data should not be kept for longer than is needed, and it must be properly destroyed or deleted when it is no longer used or goes out of date.
6. Integrity and confidentiality—Data should be processed in a way that ensures appropriate security, including protection against unauthorized or unlawful processing, loss, damage or destruction, and kept safe and secure.

The transparency element within the first principle is very important. It runs all the way through GDPR, and must form the cornerstone of a GDPR-ready approach to personal data.

To comply with these principles and the new accountability principle, internal and external policies must be updated, a clear compliance structure must be in place, responsibilities for data management allocated, staff well trained, and systems audited. GDPR also requires all necessary technical measures to be put in place to protect personal data.

In addition, it is not enough just to comply with all six of these principles; GDPR compliance requires that you must be able to show how you comply with them. Demonstrating compliance can be done through written policies and GDPR compliance programs.