Data Protection

CPE publishes GDPR guidance for community pharmacies

The materials, created by the cross-sector Community Pharmacy GDPR Working Party, discuss each of the different elements of the GDPR and how they apply to community pharmacy.

They consist of:

• Guidance for Community Pharmacy (Part 1): this should help contractors to understand the GDPR requirements, and it sets out the steps they will need to take to comply.
• Guidance for Community Pharmacy (short version) (Part 2): this has been made available to assist with staff training.
• Workbook for Community Pharmacy (Part 3): this contains a set of editable templates that contractors can use to show that they are meeting all the GDPR requirements.
• FAQs for Community Pharmacy (Part 4): this provides simple answers to key questions on the GDPR.

All the guidance documents can be downloaded from: ow.ly/GRs130jchmW

Contractors should be reassured that whilst GDPR brings a new approach to data protection, much of what becomes mandatory has been good practice in the past and pharmacy teams are used to managing personal data and are subject to considerable information governance (IG) requirements already.

Given the upcoming deadline for completion of the IG Toolkit (31st March 2018), any contractors who have not yet completed the IG Toolkit should do so immediately, and CPE recommends that this is done before you start thinking about GDPR.

To keep things as straightforward as possible, the new guidance is underpinned by the mnemonic DATAPROTECTED, giving 13 steps as the route to compliance:

1. Decide who is responsible
2. Action plan
3. Think about and record the personal data you process
4. Assure your lawful basis for processing
5. Process according to data protection principles
6. Review and check with your processors
7. Obtain consent if you need to
8. Tell people about your fair processing notice
9. Ensure data security
10. Consider personal data breaches
11. Think about data subject rights
12. Ensure privacy by design
13. Data protection impact assessment

As everybody is still getting to grips with the GDPR, there is much still to be clarified both before and after the 25th May 2018; in her blog, the Information Commissioner Elizabeth Denham admits that “GDPR compliance will be an ongoing journey”. Therefore, this guidance should be considered a starting point and we will update it as issues are clarified.

The working party is also happy to accept questions, which may be sent to any of the member organisations and selected questions with answers will be added to the FAQs document.

Contractors are reminded that CPE will hold two live webinars in early April and most of the time will be dedicated to guiding contractors through the information given in these guidance documents. Register for the webinars at: cpe.org.uk/webinar