GDPRprocess

Some of the General Data Protection Regulation's requirements on data controllers apply no matter which legal basis for processing is being used.

23 October 2019 at 10:27am

GDPR: What's your justification?

[Updated Oct.19 to add EDPB on Necessary for Contract and ICO on Consent] [Updated Sep.18 to repair links broken by the demise of the Article 29 WP website] [Updated Oct.17 to include an example where multiple justifications are appropriate]

19 April 2017 at 9:40am

GDPR: A new kind of consent

Consent

GDPRdevelopment

While some have viewed the General Data Protection Regulation's approach to consent as merely adjusting the existing regime, the Information Commissioner's draft guidance suggests a more fundamental change: "a more dynamic idea of consent: consent as an organic, ongoing and actively managed choice, and not simply a one-off compliance box to tick and file away".

25 April 2017 at 2:30pm

GDPR: moving to Information Lifecycle Registers?

[UPDATE: the Irish GDPR coalition have a nice infographic on information lifecycles under the GDPR] Anyone who has looked at an information security standard is likely to be familiar with the idea of an Information Asset Register. These cover the What and Where of information that an organisation relies on: what information do we hold, and where is it kept.

19 April 2017 at 9:46am

GDPR: Twelve Steps, Sorted

Although the Information Commissioner's "Twelve Steps to Prepare" is an excellent guide to what organisations need to do in the eighteen months before the General Data Protection Regulation becomes UK law in May 2018, following them in order from 1 to 12 may n

Jisc Security Conference 2016

19 April 2017 at 9:47am

#Jiscsec

I'll be talking on Tuesday about how the General Data Protection Regulation will create some more reasons for organisations to practise good information security.

19 April 2017 at 9:49am

Referendum: has the GDPR gone away?