GDPR FAQs

Before your 14 day trial ends you need to log into your account and add either the single monthly license or multiple user license into your basket, then checkout and pay for your subscription. Once the transaction has completed your account will automatically upgrade, straight away, and any data you have input so far will transfer to your new subscription.

When your next payment is due you need to log into your account and purchase another subscription with the new card. Once the transaction has completed your account will automatically pick up the new subscription license and all your data will be available under this license.

If you wish to use a new/different card from the one you purchased you subscription with then when your next payment is due you need to log into your account and purchase another subscription with the new card. Once the transaction has completed your account will automatically pick up the new subscription license and all your data will be available under this license.

We will attempt to take payment 3 times (3 consecutive nights)
On the 3rd failure your subscription gets cancelled, so therefore locks you out of the system.
To get back in you just need to buy another license, and all your data will be accessible again.
If you don't renew your subscription, the account is not deleted for 12 days.
You will then get an email saying your account will be cancelled and deleted in 48 hours.

You can cancel your account at any time. You simply log into your GDPR account, select Options > Settings > then click the button 'Cancel this license'. Your cancellation request should be made a couple of days before your monthly renewal billing date for the cancellation to be processed, and to avoid an automatic monthly renewal charge.

Please note: If you are not subscribed to the GDPR Software platform you do not own the licence to save, use or circulate any sample data or policies and procedures from our platform and we accept no obligations or responsibility to you in respect of unauthorised use of this data.

Yes. If you would like us to delete all your test data so you can start again with a clean account just go to Help > Request Support and submit your request. Please note: this will delete ALL data you have entered into your account so you will be starting from the beginning again.

- If you need tech support please go to Help > Request Support and submit an item. These get answered in strict chronological order and we'll get back to you as soon as we can.
- If you need sales support please email sales@gdpr-software.com and a member of the sales team will get back to you as soon as they are available, or use our live chat if available.
- If you need advice from a GDPR Specialist please purchase GDPR Support, Select GDPR Consultancy and purchase the number of hours you think you need.
- If you need Legal advice please purchase GDPR Support, Select Legal Specialist and purchase the number of hours you think you need.

If you have purchased time with either a GDPR Consultant or a Legal Specialist we pass your details on to our partners who will get in touch with you as soon as they can. The maximum wait for a response would be 72 hours but we aim to get back to you much quicker than that.

You must provide a copy of the information free of charge. The removal of the £10 subject access fee is a significant change from the existing rules under the DPA.

However, you can charge a ‘reasonable fee’ when a request is manifestly unfounded or excessive, particularly if it is repetitive.

You may also charge a reasonable fee to comply with requests for further copies of the same information. This does not mean that you can charge for all subsequent access requests.

The fee must be based on the administrative cost of providing the information.

The conditions for consent have been strengthened, as companies will no longer be able to utilise long illegible terms and conditions full of legalese, as the request for consent must be given in an intelligible and easily accessible form, with the purpose for data processing attached to that consent - meaning it must be unambiguous. Consent must be clear and distinguishable from other matters and provided in an intelligible and easily accessible form, using clear and plain language. It must be as easy to withdraw consent as it is to give it. Explicit consent is required only for processing sensitive personal data - in this context, nothing short of “opt in” will suffice. However, for non-sensitive data, “unambiguous” consent will suffice.

If you have disclosed the personal data in question to third parties, you must inform them about the erasure of the personal data, unless it is impossible or involves disproportionate effort to do so.

The GDPR reinforces the right to erasure by clarifying that organisations in the online environment who make personal data public should inform other organisations who process the personal data to erase links to, copies or replication of the personal data in question.

While this might be challenging, if you process personal information online, for example on social networks, forums or websites, you must endeavour to comply with these requirements.

As in the example below, there may be instances where organisations that process the personal data may not be required to comply with this provision because an exemption applies.

DPOs must be appointed in the case of: (a) public authorities, (b) organizations that engage in large scale systematic monitoring, or (c) organizations that engage in large scale processing of sensitive personal data (Art. 37). If your organization doesn’t fall into one of these categories, then you do not need to appoint a DPO.

Proposed regulations surrounding data breaches primarily relate to the notification policies of companies that have been breached. Data breaches which may pose a risk to individuals must be notified to the DPA within 72 hours and to affected individuals without undue delay.

There are extra requirements when the request for erasure relates to children’s personal data, reflecting the GDPR emphasis on the enhanced protection of such information, especially in online environments.

If you process the personal data of children, you should pay special attention to existing situations where a child has given consent to processing and they later request erasure of the data (regardless of age at the time of the request), especially on social networking sites and internet forums. This is because a child may not have been fully aware of the risks involved in the processing at the time of consent (Recital 65).

You must respond within one month.

This can be extended by two months where the request for rectification is complex.

Where you are not taking action in response to a request for rectification, you must explain why to the individual, informing them of their right to complain to the supervisory authority and to a judicial remedy.

If you process data about individuals in the context of selling goods or services to citizens in other EU countries then you will need to comply with the GDPR, irrespective as to whether or not you the UK retains the GDPR post-Brexit. If your activities are limited to the UK, then the position (after the initial exit period) is much less clear. The UK Government has indicated it will implement an equivalent or alternative legal mechanisms. Our expectation is that any such legislation will largely follow the GDPR, given the support previously provided to the GDPR by the ICO and UK Government as an effective privacy standard, together with the fact that the GDPR provides a clear baseline against which UK business can seek continued access to the EU digital market. (Ref: http://www.lexology.com/library/detail.aspx?g=07a6d19f-19ae-4648-9f69-44ea289726a0)

You will have less time to comply with a subject access request under the GDPR. Information must be provided without delay and at the latest within one month of receipt.

You will be able to extend the period of compliance by a further two months where requests are complex or numerous. If this is the case, you must inform the individual within one month of the receipt of the request and explain why the extension is necessary.

You must verify the identity of the person making the request, using “reasonable means”.

If the request is made electronically, you should provide the information in a commonly used electronic format.

The GDPR introduces a new best practice recommendation that, where possible, organisations should be able to provide remote access to a secure self-service system which would provide the individual with direct access to his or her information (Recital 63). This will not be appropriate for all organisations, but there are some sectors where this may work well.

The right to obtain a copy of information or to access personal data through a remotely accessed secure system should not adversely affect the rights and freedoms of others.

Where you process a large quantity of information about an individual, the GDPR permits you to ask the individual to specify the information the request relates to (Recital 63).

The GDPR does not introduce an exemption for requests that relate to large amounts of data, but you may be able to consider whether the request is manifestly unfounded or excessive.

Where requests are manifestly unfounded or excessive, in particular because they are repetitive, you can:

Charge a reasonable fee taking into account the administrative costs of providing the information; or
Refuse to respond.

Where you refuse to respond to a request, you must explain why to the individual, informing them of their right to complain to the supervisory authority and to a judicial remedy without undue delay and at the latest within one month.

The right to erasure is also known as ‘the right to be forgotten’. The broad principle underpinning this right is to enable an individual to request the deletion or removal of personal data where there is no compelling reason for its continued processing.

Under the DPA, individuals have a right to ‘block’ or suppress processing of personal data. The restriction of processing under the GDPR is similar.

When processing is restricted, you are permitted to store the personal data, but not further process it. You can retain just enough information about the individual to ensure that the restriction is respected in future.

Parental consent will be required to process the personal data of children under the age of 16 for online services; member states may legislate for a lower age of consent but this will not be below the age of 13.

In the UK specifically the Department for Digital, Culture, Media and Sport released a draft new Data Protection Bill in August 2017 which states: We will require parents or guardians to give consent to information services where a child is under the age of 13. This bill was passed to the House of Lords on 13th September 2017.

Organizations can be fined up to 4% of annual global turnover for breaching GDPR or €20 Million. This is the maximum fine that can be imposed for the most serious infringements e.g.not having sufficient customer consent to process data or violating the core of Privacy by Design concepts. There is a tiered approach to fines e.g. a company can be fined 2% for not having their records in order (article 28), not notifying the supervising authority and data subject about a breach or not conducting impact assessment. It is important to note that these rules apply to both controllers and processors -- meaning "clouds" will not be exempt from GDPR enforcement.

Any information related to a natural person or ‘Data Subject’, that can be used to directly or indirectly identify the person. It can be anything from more obvious data types such as a name, a photo, an email address, bank details or medical information; to less obvious data types such as posts on social networking websites, biometric data, a computer IP address, CCTV where facial recognition is in operation or ANPR (automatic number plate recognition) .

Under the GDPR, individuals will have the right to obtain:

Confirmation that their data is being processed;
Access to their personal data; and
Other supplementary information – this largely corresponds to the information that should be provided in a privacy notice (see Article 15).

These are similar to existing subject access rights under the DPA.

Data protection impact assessments (DPIAs) (also known as privacy impact assessments or PIAs) are a tool which can help organisations identify the most effective way to comply with their data protection obligations and meet individuals’ expectations of privacy. An effective DPIA will allow organisations to identify and fix problems at an early stage, reducing the associated costs and damage to reputation which might otherwise occur.

While not a legal requirement under the DPA, the ICO has promoted the use of DPIAs as an integral part of taking a privacy by design approach.

A controller is the entity that determines the purposes, conditions and means of the processing of personal data, while the processor is an entity which processes personal data on behalf of the controller.

A regulation is a binding legislative act. It must be applied in its entirety across the EU, while a directive is a legislative act that sets out a goal that all EU countries must achieve. However, it is up to the individual countries to decide how. It is important to note that the GDPR is a regulation, in contrast the the previous legislation, which is a directive.

The GDPR clarifies that the reason for allowing individuals to access their personal data is so that they are aware of and can verify the lawfulness of the processing (Recital 63).

You can refuse to comply with a request for erasure where the personal data is processed for the following reasons:

to exercise the right of freedom of expression and information;
to comply with a legal obligation or for the performance of a public interest task or exercise of official authority;
for public health purposes in the public interest;
archiving purposes in the public interest, scientific research historical research or statistical purposes; or
the exercise or defence of legal claims.

The right to erasure does not provide an absolute ‘right to be forgotten’. Individuals have a right to have personal data erased and to prevent processing in specific circumstances:

Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed.
When the individual withdraws consent.
When the individual objects to the processing and there is no overriding legitimate interest for continuing the processing.
The personal data was unlawfully processed (ie otherwise in breach of the GDPR).
The personal data has to be erased in order to comply with a legal obligation.
The personal data is processed in relation to the offer of information society services to a child.

Under the DPA, the right to erasure is limited to processing that causes unwarranted and substantial damage or distress. Under the GDPR, this threshold is not present. However, if the processing does cause damage or distress, this is likely to make the case for erasure stronger.

There are some specific circumstances where the right to erasure does not apply and you can refuse to deal with a request.

You will be required to restrict the processing of personal data in the following circumstances:

Where an individual contests the accuracy of the personal data, you should restrict the processing until you have verified the accuracy of the personal data.
Where an individual has objected to the processing (where it was necessary for the performance of a public interest task or purpose of legitimate interests), and you are considering whether your organisation’s legitimate grounds override those of the individual.
When processing is unlawful and the individual opposes erasure and requests restriction instead.
If you no longer need the personal data but the individual requires the data to establish, exercise or defend a legal claim.

You may need to review procedures to ensure you are able to determine where you may be required to restrict the processing of personal data.

If you have disclosed the personal data in question to third parties, you must inform them about the restriction on the processing of the personal data, unless it is impossible or involves disproportionate effort to do so.

You must inform individuals when you decide to lift a restriction on processing.

The GDPR was approved by the EU Parliament in May 2016. The regulation will take effect after a two-year transition period and, unlike a Directive it does not require any enabling legislation to be passed by government; meaning it will be in force May 2018.

In the UK, in light of Brexit, it will also come into effect with the passage into law of the Data Protection Act 2017, because potentially the UK will not be a member state of the EU.

Individuals are entitled to have personal data rectified if it is inaccurate or incomplete.

If you have disclosed the personal data in question to third parties, you must inform them of the rectification where possible. You must also inform the individuals about the third parties to whom the data has been disclosed where appropriate.

GDPR applies to any natural person in the UK whether they live there or not. GDPR compliance applies to organisations located within the EU but it will also apply to organisations located outside of the EU if they offer goods or services to, or monitor the behaviour of, EU data subjects. It applies to all companies processing and holding the personal data of data subjects residing in the European Union, regardless of the company’s location.