The ICO publishes practical advice to prepare for the implementation of the General Data Protection Regulation.

The General Data Protection Regulation (GDPR) will transform EU data protection laws when it comes into effect in 2018. With maximum fines of up to 4% of worldwide annual turnover, the consequences of non-compliance will be onerous, but many organisations are currently wondering what steps they should be taking to ensure that they will be compliant with the GDPR.

To provide practical guidance, the Information Commissioner’s Office (the governmental body responsible for enforcing data protection law in the UK) has issued a new guide summarising 12 practical steps which all organisations should be taking in preparation for the GDPR, ranging from increasing awareness of the reforms among key decision makers to ensuring that procedures are put in place for notifying data breaches and responding to requests from individuals exercising their enhanced rights under the new law. Particular care is required when collecting personal data from children.

Given the extremely detailed and lengthy nature of the GDPR, which is several times longer than the Data Protection Act 1998 it will replace, the ICO guidance will provide welcome relief for organisations keen to clarify their data protection to-do list over the next couple of years. A copy of the ICO guidance is available here.