Contractors should be reassured that whilst GDPR brings a new approach to data protection, much of what becomes mandatory has been good practice in the past and pharmacy teams are used to managing personal data and are subject to considerable information governance (IG) requirements already.
Given the upcoming deadline for completion of the IG Toolkit (31st March 2018), any contractors who have not yet completed the IG Toolkit should do so immediately, and PSNC recommends that this is done before you start thinking about GDPR.
To keep things as straightforward as possible, the new guidance is underpinned by the mnemonic DATAPROTECTED, giving 13 steps as the route to compliance:
Decide who is responsible
Think about and record the personal data you process
Assure your lawful basis for processing
Process according to data protection principles
Review and check with your processors
Obtain consent if you need to
Tell people about your fair processing notice
Ensure data security
Consider personal data breaches
Think about data subject rights
Ensure privacy by design
Data protection impact assessment
As everybody is still getting to grips with the GDPR, there is much still to be clarified both before and after the 25th May 2018; in her blog, the Information Commissioner Elizabeth Denham admits that “GDPR compliance will be an ongoing journey”. Therefore, this guidance should be considered a starting point and we will update it as issues are clarified.
The working party is also happy to accept questions, which may be sent to any of the member organisations and selected questions with answers will be added to the FAQs document.
Contractors are reminded that PSNC will hold two live webinars in early April and most of the time will be dedicated to guiding contractors through the information given in these guidance documents. Register for the webinars at: psnc.org.uk/webinar