Training Awareness campaign for any new September 17 April 18 – developments. Privacy Impact Develop a standardised (2 tier) October 17 Assessments procedure to assess all new systems / processes. Right to be Assessment by Directorate and October 2017 forgotten system of the ability of systems to comply with the right to be forgotten. Audit processing Update information surveys to Ongoing and quarterly activities include mandatory questions on legal basis for processing. Audit processing Ensure surveys are up to date. November 17 activities Lawful basis for Document the process of creating / November 2017 processing updating information assets and flows into the organsiation. Privacy Notices Create a standardised template for December 2017 rollout across BSO. Recording Consent Ensure that mechanisms are in December 2017 place to record how consent has been sought and obtained. Amending / Ensure that local (departmental) January 2017 deleting procedures for amending information information are written and made available to relevant staff. Policies / Ensure policies and associated January 2018 Procedures procedures are updated to include legal obligations under GDPR. Policies / Amend the existing breach October 2017 Procedures reporting procedure to reflect mandatory timescales and assess business impact. Contracts Existing contracts / data access January 2018 agreements should be reviewed by the relevant directorate to ensure compliance with GDPR. Provide clarity of Finalise protocol of relationships September 2017 relationship between HSC and BSO. between Data Controllers and processors. Appendix 1 Principles relating to processing of personal data Personal data shall be:
Training Awareness campaign for any new developments. September 17 – April 18 Privacy Impact Assessments Develop a standardised (2 tier) procedure to assess all new systems / processes. October 17 Right to be forgotten Assessment by Directorate and system of the ability of systems to comply with the right to be forgotten. October 2017 Audit processing activities Update information surveys to include mandatory questions on legal basis for processing. Ongoing and quarterly Audit processing activities Ensure surveys are up to date. November 17 Lawful basis for processing Document the process of creating / updating information assets and flows into the organsiation. November 2017 Privacy Notices Create a standardised template for rollout across BSO. December 2017 Recording Consent Ensure that mechanisms are in place to record how consent has been sought and obtained. December 2017 Amending / deleting information Ensure that local (departmental) procedures for amending information are written and made available to relevant staff. January 2017 Policies / Procedures Ensure policies and associated procedures are updated to include legal obligations under GDPR. January 2018 Policies / Procedures Amend the existing breach reporting procedure to reflect mandatory timescales and assess business impact. October 2017 Contracts Existing contracts / data access agreements should be reviewed by the relevant directorate to ensure compliance with GDPR. January 2018 Provide clarity of relationship between Data Controllers and processors. Finalise protocol of relationships between HSC and BSO. September 2017 Appendix 1 Principles relating to processing of personal data Personal data shall be:
GDPRoverview.docx