GDPR: practical tips for the life sciences sector

1 October 2018 | Applicable law: England and Wales

The General Data Protection Regulation (GDPR) takes effect on 25 May 2018 and introduces substantial changes to the EU data protection regime. The GDPR will reshape the relationship between businesses and customers and reform the approach to how businesses handle personal data. In our last post, we detailed out the key changes that will affect life sciences organisations. In this post, we provide our five top tips for life sciences organisations to adopt to assist with compliance prior to the May 2018 deadline.

Conduct a data audit

Before you can assess how the GDPR applies, you need to know what your organisation does with personal data. Start with the basics - the who, what, why, when, where, how approach will help map data flows.

Review consent procedures and privacy notices

Existing fair processing notices will need to be reviewed and redrafted. The process for obtaining consent will need to be reviewed to ensure it satisfies the new requirements (pre-ticked boxes or inactivity will not satisfy the GDPR requirements). Individuals will have stronger rights where consent is the ground relied on for processing. If there is another lawful ground for processing… use it.

Internal policy review

For those with limited resources, focus on the key changes that are likely to impact your business. New breach reporting obligations and accountability requirements are likely to trigger changes to internal policies. Global policies may need to contain country-specific provisions (a one-size-fits-all approach is unlikely to be sufficient).

Accountability – share the joy

Governance needs to go beyond the traditional “core” teams of legal, compliance, and information security and include all aspects of the business, most notably PR and marketing should be included to manage reputational damage. Remember your data protection officer (DPO) needs to be independent. Any managers who can influence the purpose or manner of processing will not be able to act as DPO. Consider external resources to manage costs.

Review and revise processing agreements

Focus on key data sets and material processing arrangements. Data controllers should take the opportunity to ensure the processor is also compliant with internal policies. Data processors should review the liability position and consider introducing liability caps to reduce exposure.

This article was originally published by LSX on 20 October 2017. Tech law firm JAG Shaw Baker joined Withersworldwide in August 2018 to create a unique legal offering that meets the needs of entrepreneurs, investors and technology companies across the world.

This document (and any information accessed through links in this document) is provided for information purposes only and does not constitute legal advice. Professional legal advice should be obtained before taking or refraining from any action as a result of the contents of this document.


Related experience

As a full-service law firm, we are able to provide advice and information about a wide range of other issues. Here are some related areas.

Join the club

We have lots more news and information that you'll find informative and useful. Let us know what you're interested in and we'll keep you up to date on the issues that matter to you.