The mornings are getting lighter and reasons to be cheerful increase, including even in the world of data protection. “Steady on” I hear some say but a few headaches may subside at least with the news that the ICO has recently enhanced its guide to the GDPR. In doing so, it has shone some much needed light on a number of previously murky areas of the Regulation. These include:
- More detailed explanation of the ICO’s expectations in relation to the documentation of processing activities (under Article 30).
- Further clarity on what is expected in the event of a personal data breach (under Articles 33 and 34).
- New guidance on what constitutes lawful processing, in particular in relation to performance of a contract with the data subject (Article 6(1)(b)), compliance with a legal obligation (Article 6(1)(c)), protection of vital interests (Article 6(1)(d)) and performance of a task carried out in the public interest (Article 6(1)(e)).
For more information on these developments, see Practical Law Data Protection’s recent legal update.