Data Protection Act 2018

Introducing Data Protection
Six Data Protection Principles

What are the Penalties?
What can We Get an Administrative Fine for?
What Influences the Size of an Administrative Fine?
Staff Member Responsibilities
Personal Information
Sensitive Data​

Judicial and Statutory Purposes
Safeguarding of children and individuals at risk
Individual’s vital interests
Archiving
Preventing Fraud

Information Commissioner’s Office (ICO)
Law Enforcement

• Right to Be Informed
  • Right to Be Informed: When Should Information Be Provided?
  • Best Practice Guidance: Selling/Sharing PII
  • Best Practice Guidance: Purchasing PII
  • Best Practice Guidance: Publicly Derived PII
  • Best Practice Guidance: Artificial Intelligence (AI)
• Right of Access
• Right to Rectification
• Right to Erasure (The Right to Be Forgotten)
  • When Can I Refuse to Comply with a Request for Erasure?
  • Erasing Children’s Data
• Right to Restrict Processing
  • When Processing Should be Restricted
  • Other Issues about Restricting Processing
• Right to Data Portability
• Right to Object
  • Complying with the Right to Object
  • Rejecting the Right to Object
  • Right to Object: Processing for Direct Marketing Purposes
  • Right to Object: Processing for Research Purposes
  • Rights Related to Automated Decision Making and Profiling (1)
  • Rights Related to Automated Decision Making and Profiling (2)
  • Rights Related to Automated Decision Making and Profiling (3)
  • When does the Right not apply?

Documenting and Logging Data
What Must Be Recorded?
Maintaining Records

What is Personal Information?
Who Has PII?
Who Processes PII?
Demonstrating Compliance
Protecting PII

Role of a Data Protection Officer
Involvement of the DPO
Main Responsibilities of the DPO
Working Environment for the DPO
Must We Have a DPO?

Overview: Incident Response Plan
Developing an Incident Response Plan
Preparation
Identification
Containment
Eradication
5 Whys
How to Complete The 5 Whys
Fishbone Diagram
Recovery
Lessons Learned
Incidence Response: DPOs role

External Transfers
Cross Border Transfers
Transfer Mechanisms
Derogations
Adequacy
Adequate Ways to Safeguard Transfers of PII
One-Off or Infrequent Transfers
Transferring PII Between EEA Members
Adequate Countries Outside of the EEA
EU-US Privacy Shield
Privacy Shield Overview
Privacy Shield: Mechanics
Model Clauses
Public Authority Agreements