The GDPR affects any entity that holds and processes personal information about its clients, employees or suppliers.
The definition of ‘Personal Information’ is largely the same as it has been since the introduction of the Data Protection Act 1998 therefore if the Data Protection Act has applied to up until now, then the GDPR will also apply to your organisation.
If you employ anyone within your organisation, you will be holding personal information on your employees to maintain your workforce. Information such as their name, their National Insurance Number, and their bank details all constitute ‘personal information’ and therefore GDPR applies.
If you are a sole trader & invoice your customers, you will hold personal information such as names of your point of contact and payment details. This is also defined as personal data and will bring you under the banner of GDPR.
If you’re unsure of whether or not GDPR applies to you, consider how regularly you deal with personal data and how you store, process and transmit this data. If it is a regular occurrence, you should investigate how you abide by the GDPR. The ICO website provides more information on what constitutes personal and sensitive data.
Neil Hodgson
neilh.
Delivering Compliant Customer Interactions
