Changes to the Data Protection Act - GDPR

The UK GDPR, Data Protection Act 2018, and EU GDPR extend the rights of individuals and ensure that legislation keeps pace with ever-changing technology.

Some of the changes introduced under the UK GDPR, Data Protection Act 2018, and EU GDPR include:

New rights for data subjects

• The right to be forgotten: Individuals can request the erasure of their personal data
• The right to data portability: Individuals can request their personal data to be transferred from one service provider to another
• The right to object to profiling: Individuals have the right not to be subject to decisions based solely on automated processing

Changes to consent

• Consent must be explicit, non-ambiguous, and given freely
• Consent can be withdrawn at any time

Increased fines for data breaches

• The ICO has the power to impose fines of up to 4% of total annual turnover or €20,000,000, whichever is higher

Data Protection Officers

• A designated Data Protection Officer (DPO) must be appointed to be strategically responsible for GDPR compliance

Mandatory breach notification

• Organisations must notify breaches without undue delay and within 72 hours. If there is a high risk to individuals, they must also be informed

Privacy by design

• Organisations should integrate data protection into the development of business processes and new systems, and conduct Privacy Impact Assessments (PIAs)

Need advice?

You can contact us at gdpr@derby.ac.uk