GDPR

GDPR stands for the General Data Protection Regulation. It's an EU legislation that is the framework for data protection across Europe. Companies must not only be compliant but demonstrate compliance, or face fines of up to 4% of annual global turnover or 20 million (much higher than the 500,000 fine imposed under the Data Protection Act 1998).

What does GDPR mean for me?

1. The right to be informed, about what data is being captured, and what it is used for.
2. The right of access, to the data a company holds on you. The company must provide this within 30 days of the request.
3. The right to rectification. If the data held is incorrect or incomplete, an individual can request rectification (verbally or in writing). Again, a company has 30 days to respond to this.
4. The right to erasure. Also known as the right to be forgotten. A right for individuals to have their personal data erased - within 30 days.

5. The right to restrict processing. Individuals can request restriction or suppression - which means that companies are permitted to store the personal data, but not use it.
6. The right to data portability. This allows individuals to obtain and reuse their personal data for their own purposes across different services.
7. The right to object. Individuals have the right to object to direct marketing (including profiling) and other forms of data processing (more info here).
8. Rights related to automated decision making including profiling. Individuals have the right to object to automated decision making, including profiling.

What does it mean for businesses?

There are a number of steps that businesses have to take in preparation for GDPR as outlined by the ICO (the Information Commissioner's Office) here. Rye Chocolates have followed and completed all of these steps.

• Awareness. Making key decision makers aware of GDPR and the change in law.

• Information they hold. Document the data that a company holds, where it came from, what it is used for etc.

• Privacy information. Businesses must review their current privacy information and communicate it with those affected.

• Individual rights. The 8 key rights as listed above - make sure there are procedures and processes in place to respond to any of the requests individuals have the right to make (for example, deleting personal data).

• Lawful basis for processing personal data. Identify the lawful basis for a businesses processing activity, document and update privacy notice to explain this. As explained in our privacy policy.

• Consent. Review how the business seeks, records and manages consent. Refresh any existing consents if they don't meet the new standard.

• Data breach. Have procedures in place to detect, report and investigate a personal data breach.

• Children. Obtain parental or guardian consent for any data processing activity regarding children.

• Data Protection Officers. Designate someone to take responsibility for data protection. Some businesses may be required to formally designate.

What has Rye Chocolates done?

Rye Chocolates have followed and completed all of the 12 steps outlined by the ICO in a great level of detail. Most of the steps we have taken are outlined in our privacy policy.

In addition to this, we have:

• Conducted an information audit and documented our data processing procedures.
• Trained every member of staff.
• Published an internal data breach policy.
• Published a resource portal with information on GDPR for staff.