How often should you consider Data Protection?
- 8 hours ago
- 2 min read
As a council, when you're planning something new, delivering a new service or updating a procedure, do you consider the impact on data protection?
You will be thinking of lots of things, like software to use, staff to undertake the activity, even printing or hardware needs.
All of these are important. They are part of making your new service work in practice.
It’s easy to get on with the new plan and have the satisfaction of making improvements to services or transparency, but have you considered how data protection might be affected?
Especially when timelines are tight and there is pressure to deliver quickly.
For instance, when considering a plan to engage with your community in a new way, before designing the new procedures, you should think about what information you might collect that would identify someone.
Will you be adding names to a list, collecting addresses or email addresses, taking photos or videos of people? These are the details that need to be clear before you put anything in motion.
All of these activities involve processing personal data, which means they fall within the scope of data protection law.
Before you start to process any personal data for any new purpose, the law requires you to have identified a lawful basis to process that data. This must be one of the six lawful bases set out in the UK GDPR.
You must decide which one is most appropriate for your new activity, and then design your services or procedures to meet the requirements of that lawful basis.
If you start collecting or processing data without making this choice and ensuring you meet its requirements, you risk falling foul of data protection law.
Data protection should not be something you add on at the end. It should shape how your service is designed from the start.
Time spent getting this right from the start is never wasted. It will always take less time than fixing a problem later.
Members of the public are more informed than ever about how their data should be handled, and they are increasingly confident in questioning councils on compliance, so make sure your data protection is right before you start processing.
