A Practical Guide to the General Data Protection Regulation (GDPR)

Application:
to whom does the GDPR apply?
how is this different to the Data Protection Act 1998?
will more organisations be caught by it?
what is meant by ‘designating a representative’?

Accountability:
what is this new principle?
what do we need to do about it practically?
what impact will this have on our data protection notices and privacy policies?
what does data protection by default and design actually mean?
do we have to do data protection impact assessments?

Consent:
what changes are being made to the rules on consent?
can we still rely on consent to process personal data?
how do we ‘refresh’ my consents if this is necessary?
what other reasons can we use for processing personal data if we do not want to rely on consent any longer?

Provision of information:
what information do we need to provide?
what format must the information be provided in?
to whom must the information be provided?
when must the information be provided?

Data Subjects’ Rights:
what amendments are being made to existing rights?
what new rights are introduced and what do we need to do about it?
how does the right to be forgotten work in practice?

Direct Marketing:
what changes are being made to the rules?
how must consent be obtained?
can we still rely on the soft opt-in?

Data Protection Officers:
do we need one?
who can it be?
what will they actually do?

Security:
what are the new rules about notifying security breaches to both the regulator and individuals affected?
what do we need to do comply with these rules?

Enforcement and Fining Powers:
what changes are being made?
which areas will attract the largest fines?