Do you comply with the General Data Protection Regulation (GDPR)?

Data security is crucial for all organisations, especially those working with children and young people. From 25 May 2018, you need to comply with the General Data Protection Regulation (GDPR). The GDPR enables individuals to better control their personal data, regardless of where this data is sent, stored or processed.
 
As an organisation, you need to provide individuals with: :

• Access to their own data, and information on how their data is processed;
• An easy way to transfer their personal data between service providers, (‘right to data portability')
• A right to have their personal data erased if there is no legitimate reason for retaining it; (‘right to be forgotten'); and
• Notification if their information has been hacked.

Complying with the GDPR
The Information Commissioner's Office (ICO) has created a checklist of things organisations can do to ensure compliance:

1. Awareness: Ensure that all decision makers and key people in your organisation are aware of the GDPR and appreciate its impact.
2. Information you hold: Document what personal data you hold, where it came from and whom you share it with.
3. Communicating privacy information: Review your current privacy notices and make any necessary GDPR changes.
4. Individuals' rights: Check your procedures cover all the rights individuals have, including how you would delete or provide personal data.
5. Subject access requests: Put in place procedures on how you handle requests.
6. Legal basis for processing personal data: Look at the various types of data processing you carry out, identify your legal basis for doing so and document it.
7. Consent: Review how you are seeking, obtaining and recording consent and whether you need to make any changes.
8. Children: Put systems in place to verify individuals' ages and to gather parental or guardian consent for the data processing activity.
9. Data breaches: Ensure you have the right procedures in place to detect, report and investigate data breaches.
10. Data Protection by Design and Data Protection Impact Assessments: Familiarise yourself with the guidance the ICO has produced on Privacy Impact Assessments, and work out how and when to implement them.
11. Data Protection Officers: Designate a DPO or someone to be responsible for data protection compliance.
12. International: If your organisation operates internationally, you should determine which data protection supervisory authority you fall under.

Children's personal data
The GDPR brings in special protection for children's personal data. 
Your privacy notice must be written in language that children will understand.

The Data Protection Act 2018 states that if you are relying on consent, when offering an online service directly to a child in the UK, only children aged 13 or over are able to provide their own consent.  If a child is younger, consent is required from a person holding parental responsibility.

This differs from the GDPR and legislation in other parts of Europe, where the age is 16.

What data protection risks can insurance cover?
Insurance is no substitute for complying with regulations. However, as not all data risks can be anticipated or prevented, an effective Cyber Liability insurance policy should form part of your risk management. A Cyber Liability insurance policy can cover the following type of data-related losses:

• Breach costs - support in the event of a data breach including forensic investigations, legal advice and notifying customers or regulators.
• Privacy protection - pays to defend and settle claims made against you for failing to keep people's personal data secure.
• Hacker damage - reimburses you for the costs of repair, restoration or replacement if a hacker causes damage to your electronic data.

You should speak to a specialist insurance broker who understands children's and youth organisations along with their data risks, so that you get the right protection.

For more information visit the Unity Insurance Services website or call on 0345 040 7702.