To process personal data in accordance with data protection principles you must have suitable policies in place for the pharmacy business. Following the data protection principles involves for example: Principle for each Issues to consider activity Lawfully All your processing is lawful templates C and F – Also, responsibilities, DPO, action plan, ICO fee and sign off – templates A and B Fairly and A privacy notice is provided, any objections to any processing are transparent considered and data breaches dealt with appropriately see – templates G, I, J and K Also, processors’ contracts are appropriate see template E – Adequate, relevant Personal data available only to who need to see it for the and limited for the work they do privacy by design and default apply and Data – purposes Protection Impact Assessments are carried out if required see – templates L and M Also, processors’ contracts are appropriate see template E – Accurate/up to date Records are accurate and, if relevant, up to date see template H – Form in which Psedonymisation/redaction of personal details, has been identification kept considered, as appropriate consider privacy by design and – for no longer than default see template L – necessary Security There is appropriate physical, electronic and human security see – template H Integrity Data is backed up so that it is protected against accidental loss or damage see template H – Template E: Review and with your processors Identify your processors and ensure that your contracts with them are GDPR compliant. Your existing contractual may already be compliant, your first step should be to check this or seek clarification from your processors. Your processors may include for example, your PMR provider or any external body that undertakes your payroll for you.
To process personal data in accordance with data protection principles you must have suitable policies in place for the pharmacy business. Following the data protection principles involves for example: Principle for each activity Issues to consider Lawfully All your processing is lawful – templates C and F Also, responsibilities, DPO, action plan, ICO fee and sign off – templates A and B Fairly and transparent A privacy notice is provided, any objections to any processing are considered and data breaches dealt with appropriately – see templates G, I, J and K Also, processors’ contracts are appropriate – see template E Adequate, relevant and limited for the purposes Personal data available only to who need to see it for the work they do – privacy by design and default apply and Data Protection Impact Assessments are carried out if required – see templates L and M Also, processors’ contracts are appropriate – see template E Accurate/up to date Records are accurate and, if relevant, up to date – see template H Form in which identification kept for no longer than necessary Psedonymisation/redaction of personal details, has been considered, as appropriate – consider privacy by design and default – see template L Security There is appropriate physical, electronic and human security – see template H Integrity Data is backed up so that it is protected against accidental loss or damage – see template H Template E: Review and with your processors Identify your processors and ensure that your contracts with them are GDPR compliant. Your existing contractual may already be compliant, your first step should be to check this or seek clarification from your processors. Your processors may include for example, your PMR provider or any external body that undertakes your payroll for you.