General Data Protection Regulation (GDPR): Update

There are now fewer than 100 days before the General Data Protection Regulation (GDPR) comes into force across the EU.

UCL has begun to prepare for the regulation.

What has UCL done on GDPR so far?

The UCL GDPR Preparedness Project was established in July 2017 and has been assessing UCL's readiness for GDPR. The project found that UCL, like a large number of Universities and businesses across the EU, is not currently compliant.

In January a programme was presented to the UCL Senior Management Team (SMT) to deliver the necessary changes to bring UCL into compliance, but also to plan a further two-year process of embedding data-sensitive cultural change within the university. This programme was unanimously supported by SMT and received full funding for its proposed work.

There are two phases to the programme: Investigation Phase (Jan 2018-Dec 2018) and Implementation Phase (Dec 2018-beyond). However there is overlap, and you will see some implementation in the first phase as we identify quick wins.

For more details about the programme please see the UCL GDPR Website.

What can you and your department do to prepare?

Open staff events are planned throughout the programme. These will be advertised and communicated throughout the programme. The next event is on Wednesday 21 February 2018, 2-3pm to be held at 26 Bedford Way LG 04 (UCL Psychology). All are encouraged to attend.

Familiarise yourself with the GDPR

- Visit the ICO Website: https://ico.org.uk/

- Visit the EU GDPR website: https://www.eugdpr.org/

- Look out for GDPR in the media.

In your departments, start to think about your policies and processes

- Are you compliant with the current DPA (1998)?

- Do you process personal data? If so, why? And do you need to?

- Do you retain personal data?

- Do you need to retain personal data?

- Do you have any processes that have not been updated for some time and need reviewing?

Talk about GDPR with your staff

Support and advice - your first 'port of call' should always be the UCL GDPR website where you will find:

- UCL GDPR Programme information

- FAQs

- Updates to legislation

- Webinars

- Guidance

This page is updated regularly, so please continue to check it.

You may contact the programme using gdpr@ucl.ac.uk

Professor Graham Hart, Dean of UCL Faculty of Population Health Sciences and Chair of UCL GDPR Project Board