Data Management

Question 1

What is GDPR?

Answer 1

GDPR is the General Data Protection Regulation (2016), that came into effect on the 25th May 2018. It aims to create a single data protection regime for the European Union

Question 2

What Act Implemented the GDPR in the UK?

Answer 2

The Data Protection Act (2018), which replaces the Data Protection Act 1998 after 20 years.

Question 3

What do you need to do if you have a data breach?

Answer 3

Notify the Information Commissioners Office (ICO) within 72 hours of the breach occurring.

Question 4

What are the fines for non-compliance with GDPR?

Answer 4

Up to 4% of global turnover, or €20 million. (Whichever is greater)

Question 5

PACN

What are the principles of Data Protection Act 2018?

Answer 5

• Processed lawfully, fairly and in a transparent manner
• Collected for specified and legitimate purposes
• Accurate
• Not transferred to countries with less info than your own

Question 6

What are the 8 Individual Rights Under GDPR?

Answer 6

1. Right to Information
2. Right of Access
3. Right of Rectification
4. Right to Erasure
5. Right to Restrict Processing
6. Right to Data Portability
7. Right to Object
8. Right to Automated Decision Making

(IARERDOA)

Question 7

What is an SAR?

Answer 7

Subject Access Request – Demand that the individual be given all the information that a company holds on them.

Question 8

When was the Freedom of Information Act Enforced, and what does it do?

Answer 8

The freedom of information Act came into effect in 2000, it allows an individual to request access to information held by a public body. The public body is required to provide that information (normally in 20 working days) in the requested format, however they can charge a fee for this.

Question 9

mentioned in summary of experience

What are the principles of GDPR 2016?

Answer 9

A. There are seven:
(1) Lawfulness, fairness and transparency.
(2) Integrity and confidentiality – keep it secure.
(3) Accuracy.
(4) Data minimization – only collect it when you need.
(5) Purpose Limitation – be specific about the purpose of the data collection.
(6) Accountability – record and prove compliance.
(7) Storage Limitations – store data for a necessary limited period and then erase.

Question 10

Give me an example of how your company is compliant with GDPR

Answer 10

When we send out marketing emails to prospective purchasers, we send emails individually rather en masse. This is so that the personal details of everyone are protected.

On marketing emails, we give people the right to be removed from our database.