GDPR Compliance: The Position Post 25 May 2018

Although 25 May 2018 had garnered an almost sacred status in the calendars of employers, the inconvenient truth is that GDPR compliance does not end on this date and will require a concerted ongoing effort to be maintained. The ICO has stated that GDPR compliance should be viewed as an evolutionary process for organisations, with 25 May simply being the date the legislation took effect. The ICO warned that no business stands still and organisations will be expected to continue to identify and address emerging privacy and security risks in the weeks, months and years beyond May 2018.

As a reminder, from an HR perspective, the following steps should ideally have been taken prior to 25 May: