GENERAL DATA PROTECTION

REGULATION
Guidance Notes

What is the GDPR?  Data must only be obtained for specified and
Currently, the law on data protection requiring the lawful purposes;
handling of data which identifies people to be done in  Data must be adequate, relevant and not
a fair way, is contained in the Data Protection Act excessive;
1998 (DPA).  Data must be accurate and up to date;
 Data must not be kept for longer than
The EU will introduce new legislation, called General necessary;
Data Protection Regulation (GDPR) that will replace
 Data must be processed in accordance with
the current EU structure on the handling of data.
the “data subject’s” (the individual’s) rights;
Because of this, the UK Government will introduce a
new Data Protection Act to replace the current one.  Data must be securely kept;
 Data must not be transferred to any other
The new Act, which will implement the requirements country without adequate protection in
of the GDPR in the UK, will come into effect no later place.
than 25th May 2018 which is the date that GDPR will
apply to all EU member states. In addition the GDPR contains the following changes:

Despite the fact that the UK will leave the EU in 2019,  Enhanced documentation to be kept by data
the Government has confirmed that GDPR will still controllers;
take effect in the UK.  Enhanced privacy notices;
 More detailed rules regarding ‘consent’;
The Information Commissioner’s Office (ICO) is the  Mandatory data breach notification
authority responsible for ensuring compliance with requirements;
the law on data protection. It publishes good practice  Enhanced data subject rights;
guidance for data controllers and data processers (see
Key Definitions later) to assist compliance. Current  New obligations on data processors;
ICO guidance on GDPR makes up this guidance note.  Expanded territorial scope;
 Appointment of Data Protection Officers;
 Significant increases in the size of fines and
Why is the law changing? penalties for non-compliance.
It had become increasingly clear that the current
statutory framework was not “fit for purpose”. Many of the implications of the new GDPR will affect
Personal data is now being used in ways that were not companies on a commercial level. However, it also has
envisaged in the mid 90s, mainly down to the growth an impact on the following areas from a
of the internet and the changes in online activities. HR/employment perspective:
Social media, advertising and email marketing are a
few examples of areas in which personal, and  Documentation to be kept by data
sometimes sensitive, data is hosted and processed controllers;
using principles that are not appropriate or safe.  Data subject rights;
 New obligations on data processors and
appointment of data protection officers;
Key principles  Data breach notification requirements;
The current Data Protection Act sets out eight  Fine and penalties for non-compliance.
principles for the processing of data. These will remain
once GDPR is introduced. They are:
Key definitions
 Data must be processed fairly and lawfully; Personal data – Under GDPR, this means “any
information relating to an identified, or identifiable

1 | ©Peninsula Business Services Limited | v.1 November 2017 | DAT01 GDPR Guidance Note
natural person (data subject); an identifiable natural specific and lawful purpose without being processed
person is one who can be identified, directly or any further. Any personal data should be limited to
indirectly, in particular by reference to an identifier only that which is relevant.
such as a name, an identification number, location In practical terms, employers should not ask for
data, an online identifier or to one or more factors personal or sensitive data relating to an employee
specific to the physical, physiological, genetic, mental, unless they can demonstrate a lawful, fair or obvious
economic, cultural or social identity of that natural reason for it. Any personal data that is held in relation
person”. to an employee should be accurate, kept up to date and
only held for as long as is necessary.
Special Categories of Personal Data (what we
currently call “Sensitive” Personal Data) – Under GDPR states: [data should be kept for] “no longer
GDPR, this will mean data relating to: than is necessary for the purposes for which the
personal data are processed; personal data may be
 Racial or ethnic origin; stored for longer periods insofar as the personal data
 Political opinions; will be processed solely for archiving purposes in the
 Religious or philosophical beliefs; public interest, scientific or historical research
purposes or statistical purposes subject to
 Trade union membership;
implementation of the appropriate technical and
 Physical or mental health conditions; organisational measures required by the GDPR in
 Sex life or sexual orientation; order to safeguard the rights and freedoms of
 Genetic data; individuals.”
 Biometric data.

Data subject – in both DPA and GDPR, this means Employee rights
the subject of personal data. It doesn’t include Data subjects (your employees, in this context) have
deceased individuals or an individual who can’t be the following rights under the GDPR:
identified/distinguished from others. You would need
to show pure anonymity in order that a subject would  The right to be informed;
not be caught.  The right of access;
 The right to rectification;
Data controller – the data controller is the decision
maker. Under the GDPR the data controller is the  The right to erasure;
natural or legal person, public authority, agency or  The right to restrict processing;
other body which, alone or jointly with others,  The right to data portability;
determines the purposes and means of processing of  The right to object;
personal data.  Rights in relation to automated decision
making and profiling.
Data processor – under GDPR this is a natural or
legal person, public authority, agency or other body Those highlighted bold are those most pertinent to the
which processes personal data on behalf of the HR function.
controller. This person acts only under instruction of
the data controller, keeping personal data secure from The right of access. This is what we currently know
unauthorised access, loss or destruction. as a subject access request. This gives individuals a
right to request production of data held on them.
Processing – in both pieces of legislation this means Right now, a request must be complied with within 40
the obtaining, recording or holding of information or days (unless an exemption applies) and employers can
data or the carrying out of any operation or set of charge the employee a £10 fee. Under GDPR, the
operations on the information or data, including: rules will be different.
access, storage, retrieval, disclosure and
erasure/deletion. Information will have to be provided as soon as
possible and within one month at the latest, which can
be extended by a further 2 months where requests are
Documentation to be kept by data controllers complex or numerous. If this is the case, you must
Personal data should only be kept where there is a inform the individual within one month of the receipt
legitimate interest, such as a contractual or statutory of the request and explain why the extension is
requirement. Once obtained it should be used for a necessary.

2 | ©Peninsula Business Services Limited | v.1 November 2017 | DAT01 GDPR Guidance Note
 damage or distress, this is likely to make the case for
Employers will not normally be able to charge a fee, erasure stronger.
however, ICO guidance states that “you can charge a
‘reasonable fee’ when a request is manifestly
unfounded or excessive, particularly if it is repetitive”. Consent
They also advise that “You may charge a reasonable Except where a lawful basis already applies, data
fee to comply with requests for further copies of the controllers must obtain the consent of the data subject
same information. This does not mean that you can in order to process their data.
charge for all subsequent access requests. The fee must
be based on the administrative cost of providing the Where consent is required, it will have to be a “freely
information”. For example, this may be when the given, specific, informed and unambiguous indication
employee asks for a copy of the information to be sent of the data subject’s wishes by which he or she, by a
to them, and another copy to be sent to their legal statement or by a clear affirmative action, signifies
adviser. agreement to the processing of personal data relating
to him or her”.
The following information needs to be produced:
Consent will have to be obtained via free-standing
 A description of the personal data, the notices rather than being held within an employee
purpose for which it is processed, recipients, handbook, for example.
retention period and rights of rectification,
erasure, restriction and objections. When obtaining consent, certain pieces of information
 A copy of the information comprising the will need to be included i.e.:
data.
 Details of the source of the data.  The identity of the data controller;
 What the data is processed for (some
The right of rectification. Individuals are entitled to processes will require their own specific
have inaccurate data rectified without undue delay. consent);
The ICO guidance states that this should occur within  How the data is processed;
1 month, or 2 months for complex requests. If no  The right to withdraw consent at any time.
action is to be taken, employers must explain why to
the individual, informing them of their right to The Information Commissioner is currently creating
complain and to a judicial remedy. guidance to assist data controllers with how to obtain
consent, however, this has not yet been finalised.
Employers would also need to consider, from a
separate perspective, how the error occurred in the
first place. New obligations on data processors and
appointment of Data Protection Officers
The right to erasure (‘the right to be forgotten’).
The introduction of “accountability” makes the data
This enables individuals the right to request that
processor responsible for demonstrating that they
personal data be deleted or removed where there is no
comply with the GDPR principles. Businesses will
compelling reason for its continued processing.
need to:
The right to erasure does not provide an absolute
‘right to be forgotten’ and can occur where, for  Implement measures to ensure and
example: demonstrate compliance;
 Maintain documentation/records on
 The personal data is no longer necessary in processing activities;
relation to the purpose for which it was  Where appropriate appoint a Data
originally collected/processed. Protection Officer (DPO);
 The individual withdraws consent.  Use data protection impact assessments
(DPIA).
Under the DPA, the right to erasure is limited to
processing that causes unwarranted and substantial As well as the obligation to provide comprehensive,
damage or distress. Under the GDPR, this threshold clear and transparent privacy policies, if an
is not present. However, if the processing does cause organisation has more than 250 employees, employers
must maintain additional internal records of their

3 | ©Peninsula Business Services Limited | v.1 November 2017 | DAT01 GDPR Guidance Note
processing activities. Organisations with less than 250 appoint one due to the increased focus on
employees are only required to maintain records of accountability in GDPR.
activities related to higher risk processing, such as:
A DPO must report into the highest level of
 Processing personal data that could result in management within the organisation (ie board level)
a risk to the rights and freedoms of and have adequate resources provided to enable them
individual; or to meet their GDPR obligations. A DPO should not
 Processing of special categories of data or be dismissed or penalised for performing their tasks.
criminal convictions and offences.

What do organisations need to record? Data breach notification requirements

A personal data breach means a breach of security
 Name and details of your organisation (and leading to the destruction, loss, alteration,
where applicable, of other controllers, your unauthorised disclosure of, or access to, personal data.
representative and Data Protection Officer); This means that a breach is more than just losing
 Purposes of the processing; personal data. It may include:
 Description of the categories of individuals
and categories of personal data;  Inappropriate access controls (not using
passcodes) which allow unauthorised use;
 Categories of recipients of personal data;
 Equipment failure;
 Details of transfers to third countries
including documentation of the transfer  Human error;
mechanism safeguards in place;  Unforeseen circumstances such as
 Retention schedules; fire/flood;
 Description of technical and organisational  Hacking attack.
security measures.
A breach must be reported within 72 hours of its
The GDPR requires organisations to appoint a Data discovery. Employers will be permitted to provide
Protection Officer (DPO) if you: information in phases where a full investigation is not
possible within that timeframe.
 Are a public authority or body (other than a
It is likely that employers will need to have a policy on
court);
reporting breaches under GDPR. All those within an
 Carry out large scale systematic monitoring organisation who are responsible for complying with
of individuals (for example, online behaviour GDPR will have to be aware of the circumstances
tracking); or under which a breach must be notified, and how it
 Carry out large scale processing of special must be done.
categories of data or data relating to criminal
convictions and offences. In some cases, the individual whose data is involved in
the breach must also be notified i.e. where the breach
The DPO can be an existing employee whose is likely to result in a high risk to the rights and
responsibilities lend themselves to taking freedoms of individuals.
responsibility for GDPR compliance. Alternatively,
employers may wish to recruit or contract the role out Fine and penalties for non-compliance
externally. A maximum fine of up to €10 million or 2% of global
turnover (whichever is greater) can be applied where
GDPR does not require DPOs to have any specific the following occurs:
qualifications to undertake the role, but it does
stipulate that they have professional experience and  Failure to maintain records of processing
knowledge of data protection law appropriate to the activities;
type of processing an organisation carries out.
 Failure to appoint a DPO;
One DPO may be responsible for a group of  Processing data without consent of the data
companies. subject;
 Failure to notify a breach to the supervisory
Employers who do not meet the definition of a authority or the data subject;
company who requires a DPO may still choose to

4 | ©Peninsula Business Services Limited | v.1 November 2017 | DAT01 GDPR Guidance Note
  Failure to carry out a data protection impact on the lawful basis of “performance of a
assessment in relation to high risk contract” for most data processing, but
processing of personal data. potentially not all processing
7. Consent – review how you obtain consent for
A maximum fine of up to €20 million or 4% of global processing data
turnover (whichever is greater) can be applied where 8. Children – reviewing procedures for verifying
the following occurs: ages and obtaining parental/guardian consent
(not likely to have a great impact on the area of
 Failure to provide data subjects with employment)
transparent information in a concise, 9. Data breaches – review how you would notify a
intelligible and easily accessible form for the breach
existence of their rights under GDPR; 10. Impact assessments – consider how to implement
 Failure to demonstrate that the data subject data protection impact assessments
has consented to the processing of his/her 11. Data Protection Officer – do you need a DPO?
data; Who will ensure your compliance with GDPR?
12. International – If you operate in more than one
 Failure to comply with the rights of access,
member state, determine a lead data protection
rectification and erasure;
supervisory authority.
The above lists are not exhaustive.
-------------------------------------------------------------

Our HRface2face service consists of a team of

How to prepare advocates equipped to conduct, or support and assist
The ICO’s “12 steps to take now” guidance sets out you to conduct, any face to face meeting you are
the following areas that employers should consider: undertaking with your staff. For further information
please speak to your HR Expert and visit:
1. Awareness – let the relevant people in your www.peninsulagrouplimited.com/services/hr/hr-
organisation know that the law is changing face2face
2. Information audit – check what data you hold and
who you share it with Occupational Health intervention and Employee
3. Privacy information – check your current privacy Assistance Programmes are essential tools to
notices and make a plan for change effectively manage absence in the workplace, to
4. Individuals’ rights – check how you currently support staff and to add value to your business. We
comply with individuals’ rights e.g. complying can provide you with the details of Health Assured, a
with a subject access request or deleting personal company who can provide such services. For further
data information please speak to your HR Expert and visit:
5. Subject access requests – plan how you will make www.healthassured.co.uk
changes to the process when the new law is here
6. Lawful basis – check you have a lawful basis for
processing data. Employers who process data for
employment purposes are likely to be able to rely

Need Further Advice?

T: 0844 892 2772 E: [email protected] W: peninsula-uk.com

5 | ©Peninsula Business Services Limited | v.1 November 2017 | DAT01 GDPR Guidance Note