When I speak to business owners that know they have changes make ahead of the GDPR, the most common thing I hear is that they have loads of time before starting work. Whilst there are still just short of 9 months to complete preparations, some companies are already too late.

There are a number of things to consider:

  1. If it is left to last minute, will there be consultants available? The prudent companies have already started working with them, and diaries will very probably be full from early next year for experienced consultants.
  2. If there is a lot of work to be done in a shortened period, how will it impact your business to move staff resource on to the actions required? Planning adequately in advance allows you to minimise the impact on your resources.
  3. The authorities have not yet clarified some of the regulations, especially around using legitimate interests as a lawful basis for processing data. If you need to request consent for keeping what might be a large proportion of your existing database of prospective clients, this will take a few months to maximise the return.
  4. The process of becoming aligned with compliance will almost certainly involve planning, completing risk and impact assessments, designing new systems, changing a larger than anticipated proportion of your procedures and policies, contractual changes with partners, staff training, amendments to your website amongst many other areas. Testing and reviews will also form part of the plan.
  5. Sometimes, just identifying what information you have will take months in itself. What format is it stored in, where it is stored, where it is backed up, what type of information you have (is it sensitive?), do you hold information on children? In some instances moving all of your data in to a common application will allow you to become significantly more efficient with the added benefit of future proofing.

Remember, fines and ICO action are not the reasons you should be trying to avoid a breach. The real damage is reputational, and the cost of clean-up.