TASKEATER, QUANTANITE
& GROWTHONICS GDPR
STATEMENT OF COMPLIANCE

The data protection “principles” set out the rules by which personal data can be processed. It means that we must be open and transparent about our processing; only process data for a particular purpose; maintain the minimal amount of data and keep it accurate; only keep the data for as long as we have a lawful reason to do so; we must ensure that personal data is kept secure; and, we have to be able to demonstrate that we are compliant (the “accountability principle”)

For processing to be lawful we have to identify a “lawful basis for processing”. You’ve probably heard of consent which is where we get an individual’s permission to process their data, but there are other (and sometimes more relevant) lawful basis for processing, such as for the performance of a contract; because the law tells us we must process data in a particular way; or because we are able to demonstrate a legitimate interest, which means that we may want to process an individual’s data in a different way, but we have to make sure it doesn’t infringe an individual’s rights and freedoms.

We also have to be careful where in the world we process personal data. Generally, as long as we process the data in the UK or the EU, this is fine, but if we need to process the data outside this area, we have to make sure an “appropriate safeguard” is in place, which usually means making sure the country has adequate data protection laws (as determined by the UK government) or we put a processing contract in place (usually call Standard Contractual Clauses or “SCC”). It’s important to understand here, that “processing” includes everything we do with personal data, including storing, sharing, manipulating, editing, deleting, so when we think about where in the world an individual’s data is processed this is includes storing data in the cloud, or using a third-party to process the data.

The GDPR grants individual’s a range of rights including: the right to be informed (so they know how we process their data – usually covered in a privacy policy); right of access, to get access to their data; rights to ensure the data is accurate or deleted when no longer used; as well as rights to object to certain types of processing activity.