Data protection compliance is often assumed to be relevant only to large organisations. However, the requirements of the UK GDPR and the Data Protection Act 2018 are applied to businesses of all sizes.
Whenever personal information is collected, stored, used or shared, responsibilities are created. Customer details, employee records, supplier information, email addresses and website enquiries must all be handled appropriately.
For many small businesses, compliance failures are not caused deliberately. Instead, gaps are often created through outdated documents, unclear procedures or a lack of awareness.
The following GDPR mistakes are commonly identified within small organisations.
1. An Outdated Privacy Policy Is Being Used
A privacy policy should clearly explain how personal data is collected, why it is required, how it is used and how long it will be retained.
In many businesses, a privacy policy is created once and is then left unchanged. However, changes may be made to systems, suppliers, marketing activity or data-handling processes over time.
Where these changes are not reflected, inaccurate information may be provided to customers and employees.
Privacy policies should therefore be reviewed regularly and updated whenever data-processing activities are changed.
2. More Personal Data Is Being Collected Than Necessary
Only the personal information required for a specific purpose should be collected.
For example, information may be requested through website forms, application processes or customer enquiries without a clear business need being established.
Where unnecessary data is collected, additional risk is created. The organisation may also be found to have breached the principle of data minimisation.
Each piece of personal information being requested should be justified and linked to a clear purpose.
3. Personal Data Is Being Retained Indefinitely
Personal information should not be kept for longer than it is needed.
Despite this requirement, old customer records, unsuccessful job applications, historic employee files and inactive mailing lists are often retained without review.
A clear retention policy should be established. Retention periods should be documented, and information should be securely deleted when it is no longer required.
By doing so, the amount of data being held can be reduced and unnecessary exposure can be avoided.
4. Marketing Consent Is Being Misunderstood
Consent is often treated as the default legal basis for all marketing activity. However, consent must be freely given, specific, informed and capable of being withdrawn.
Pre-ticked boxes, unclear wording and bundled permissions should not be relied upon.
Where email marketing is being carried out, the requirements of both data protection law and the Privacy and Electronic Communications Regulations should be considered.
Marketing lists should also be reviewed to ensure that appropriate permissions or lawful grounds are in place.
5. Data Breaches Are Not Being Properly Recorded
A data breach does not only involve a cyberattack.
A breach may occur when an email is sent to the wrong recipient, paperwork is lost, personal information is disclosed incorrectly or access is gained by an unauthorised person.
All data breaches should be documented, even where notification to the Information Commissioner’s Office is not required.
Where a breach is likely to create a risk to individuals, regulatory notification may need to be made within the required timeframe.
A clear breach-management procedure should therefore be implemented and understood by all relevant employees.
6. Employees Have Not Been Properly Trained
Policies alone will not ensure compliance.
Employees who handle personal data should be made aware of their responsibilities. Training should be provided on secure data handling, recognising breaches, responding to data requests and avoiding common errors.
Training should also be refreshed regularly and recorded as part of the organisation’s compliance evidence.
Without appropriate awareness, even well-drafted policies may not be followed in practice.
7. Data Protection Responsibilities Have Not Been Assigned
Within some small businesses, responsibility for data protection is not clearly allocated.
As a result, privacy notices may not be reviewed, requests may not be answered correctly and data breaches may not be managed consistently.
A suitable person should be appointed to oversee compliance. Depending on the organisation’s activities, a formal Data Protection Officer may also be required.
Where an internal appointment is not practical, external data protection support may be obtained.
8. Third-Party Suppliers Are Not Being Checked
Personal data is often processed by external suppliers, including payroll providers, cloud storage services, software platforms, marketing agencies and IT support companies.
Although the processing may be outsourced, responsibility is not removed from the business.
Appropriate due diligence should be carried out, and suitable data-processing agreements should be put in place.
The location in which data is stored and the safeguards applied to international transfers should also be understood.
9. Subject Access Requests Are Not Being Managed Correctly
Individuals are provided with rights over their personal information, including the right to request access to the data being held about them.
When a Subject Access Request is received, it must be identified promptly and handled within the required period.
Requests may be made verbally or in writing and do not need to include specific legal wording.
A documented procedure should be available so that requests can be recognised, recorded and answered correctly.
10. Compliance Is Being Treated as a One-Off Exercise
Data protection compliance should not be viewed as a document that is completed and then forgotten.
Business processes, technology, staffing and regulatory guidance are changed regularly. As a result, policies and procedures should be reviewed as part of an ongoing compliance programme.
Records should be maintained, risks should be assessed and improvements should be made where gaps are identified.
How Can Ilisi Expert Legal Compliance Help?
A comprehensive and practical approach to data protection compliance is provided by Ilisi Expert Legal Compliance.
Support can be provided with:
- Data Protection Officer services;
- UK, EU and EEA representation;
- privacy policies and notices;
- data protection policies and procedures;
- record-keeping requirements;
- data breach management;
- Subject Access Requests;
- staff training; and
- ongoing compliance reviews.
A customised service can be provided to reflect the structure, activities and regulatory obligations of your organisation.
Data protection should not be left to chance. By appropriate policies, procedures and oversight being put in place, risks can be reduced and customer trust can be protected.
To discuss your organisation’s data protection requirements, contact Ilisi Expert Legal Compliance for further information.
