Frequently Asked Questions

Yes, if your organisation is:

1. Public authority – where the data processing is carried out by public authorities, exempting courts and independent judicial authorities.
2. Companies that handle large scale data regularly – where the processing of user data is the main activity and looks at data subjects on a large scale.
3. Companies that handle large scale special data categories – where processing of special data as defined by GDPR happens regularly at a large scale.

Although, the ICO recommends appointing a DPO regardless of the size of your organisation.

Still not sure, don't worry, give us a call and we can talk it through with you.

If you need a DPO, it should be a suitably qualified person, either a Certified DPO, or a Data Protection Practitioner.

The DPO must be independent and have no conflicts of interest, i.e. not a member of another department, or a director of the company.

The UK GDPR introduces a duty on all organisations to report certain personal data breaches to the relevant supervisory authority. You must do this within 72 hours of becoming aware of the breach, where feasible.

You should be reporting reportable breaches to the ICO within the regulatory timescale of 72 hours.

You should be logging, recording incidents, and reporting on outcomes, lessons learned, and preventative measures.

If you’re running a small business, group or charity, you’ve probably got information about people stored as contacts on your phone or computer, or in notes or other documents.

By law, people can ask you for a copy of any information that’s to do with them. It might be saved on your system, but if it’s about them, it’s their personal data, and they have a right to see it.

If they ask you for a copy of it, by phone, in person, or in writing, they have made a ‘subject access request’ (SAR), and you need to take action.

You are required to answer a request ‘no later than one calendar month’, this is a regulatory deadline.

The UK GDPR provides the following rights for individuals:

- The right to be informed.

- The right of access.

- The right to rectification.

- The right to erasure.

- The right to restrict processing.

- The right to data portability.

- The right to object.

- Rights in relation to automated decision making and profiling.

Our consultants have a combined 45 years of experience.

DR Compliance Ltd has supported organisations in the fields of Transport, Government Departments, Police, Cyber Security, Technology, Healthcare, Financial Services industries, Higher Education Institutes, Marketing Organisations, and Public Inquiries.