What Does The UK’s Data Protection Bill Mean For Business?

The UK recently published the final version of a law to replace its current data security and privacy rules.

The Data Protection Bill (DPB) will allow UK businesses to continue doing business with the EU post-Brexit. The DPB should provide a relatively easy transition for businesses gearing up for the forthcoming EU legislation.

In May 2018, the GDPR will become the data security and privacy law in the EU. UK organisations have been preparing to meet these new rules, including the right to erasure, 72-hour breach notification, and stricter record keeping requirements.

The DPB should, in theory, provide an easy transition for UK businesses after March 2019, the tentative date for the UK leaving the EU. Why? Because the DPB is effectively the General Data Protection Regulation, it’s referenced directly in the law.

Complexities

However, it’s worth noting that the DPB is not a simple piece of legislation.

A large segment of the bill is devoted to exemptions, restrictions, and clarifications that supplement the language in GDPR.

The core of the bill is found in Part 2, wherein these various tweaks are laid out including; for personal data related to health, scientific research, criminal investigations, employee safety, and public interest. The actual fine print is buried at the end of the DPB in a long section of “schedules”.

For example, GDPR legislation related to the right to erasure, data rectification, and objection to processing, doesn’t apply to investigations into financial mismanagement or public servants misusing their office. In effect, the targets of an investigation lose control of their data.

While the goal of Brexit may have been to escape EU regulations, the Data Protection Bill essentially keeps the rules in place.

Differentiations

There are also a few surprises in the new UK law.

The DPB grants regulators at the UK’s Information Commissioner’s Office (ICO) new investigative powers through “assessment notices”. These notices allow the ICO staff to enter the premises of an organisation, examine documents and equipment, and observe processing of personal data. Effectively, UK regulators will have the ability to audit an organisation’s data security compliance.

Under the existing UK data law, the ICO can only order these non-voluntary assessments against government agencies, such as the NHS. The DBP expands mandatory data security auditing to the private sector.

If the ICO decides the organisation is not meeting DPD compliance, these audits can lead to enforcement notices that point out the security shortcomings along with a schedule of when they should be corrected.

The ICO also has the power to issue fines of up 4% of an organisation’s worldwide revenue. This is the same level of monetary penalties as in the original GDPR.

For UK companies (and UK-based multinationals) that already have security controls and procedures in place, the DPB’s rules should not be a difficult threshold to meet. However, for companies that have neglected basic data governance practices, particularly for the enormous amounts of data held in file systems, the DPD will come as a surprise.

Information Age:

You Might Also Read:

A 9-Step Guide For GDPR Compliance:

UK Deal With EU On Post-Brexit Data Sharing:

GDPR - 10 Things You Must Know:

 

« Thomson Reuters Create A Knowledge Meta-Graph
Social Media & Crisis Management »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Perimeter 81 / Zero Trust Network Access Guide

Perimeter 81 / Zero Trust Network Access Guide

Curious how you can Implement a Zero Trust roadmap with insights from Gartner? Download this free report for a limited time only.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Free Access: Cyber Security Supplier Directory listing 5,000+ specialist service providers.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Biscom

Biscom

Biscom offers solutions for secure file transfer, synchronization, file translation, and mobile devices, designed to deliver mission-critical reliability, streamline workflows and reduce costs.

SecureNow Insurance Broker

SecureNow Insurance Broker

SecureNow is a commercial insurance broker based in India. Services offered include Cyber Risk insurance.

Seceon

Seceon

Seceon OTM, is a cyber security advanced threat management platform that visualizes, detects, and eliminates threats in real time.

Convercent

Convercent

We offer comprehensive and integrated compliance management, reporting, and analytics. A 360-degree view of compliance drives efficiency by aligning initiatives and data into a single dashboard.

VMRay

VMRay

VMRay delivers advanced threat analysis and detection that combines a unique agentless hypervisor-based network sandbox with a real-time reputation engine.

Orca Security

Orca Security

Orca Security delivers full stack visibility including prioritized alerts to vulnerabilities, compromises, misconfigurations, and more across your entire inventory on all your cloud accounts.

Deepwatch

Deepwatch

deepwatch’s cloud SecOps platform and relentless customer focus are redefining the managed security services industry.

Broadcom

Broadcom

Broadcom is a global technology leader that designs, develops and supplies a broad range of semiconductor and infrastructure software solutions.