This article has been written by Gordon Hockey, PSNC Director of Operations and Support, and is part of a series of articles for contractors about the General Data Protection Regulation (GDPR) and the associated (currently draft) UK Data Protection Act 2018 (DPA 2018), which both come into force on 25th May 2018. The articles accompany the GDPR guidance and contractor workbook.

Data security was important before the GDPR and it remains important after its introduction. Perhaps the key difference is that you need to think about this and demonstrate compliance proactively before any problems occur. Up until now, you might have ‘got away’ with just doing what you’ve done for a while and promising to improve if there was a problem.

In the GDPR Workbook, we list many of the existing templates you may have, or you may have equivalent practices / documents through which you will seek to ensure the physical, electronic and human security of personal data.

An example of each might be:

The GDPR is making everybody think about how they process personal data, including how they transfer personal data to others and this should not stop after 25th May 2018.

As regards personal data breaches, the first point is to seek to avoid them through good practice, procedure and the right culture in the organisation; and if they happen deal with them quickly and sensibly. In terms of the GDPR, there are three levels:

1. Any personal data breach – record all data breaches in the Workbook, however minor (and learn from them).
2. When it is ‘likely’ to result in a risk to the rights and freedoms of the patient or other data subject – record the data breach and notify the Information Commissioner’s Office (ICO). What needs to be reported may change over time. Everybody will probably be cautious at the start and over report data breaches, the real danger here being that the ICO becomes overloaded with information and misses the real problems.
3. When it is ‘highly likely’ to result in a risk to the rights and freedoms of the patient or other data subject – record the data breach, notify the ICO and tell the patient or other data subject (although as pharmacists are subject to a duty of candour, they may decide to tell the patient about something before this stage).

As a rough guide, because each data breach must be considered against its own facts, here are some examples:

For more information and guidance on GDPR, please visit psnc.org.uk/GDPR

Read the next instalment (12 and 13. Data protection by privacy and design and the Impact Assessment) here.