If you have heard about data privacy then you have no doubt heard about the GDPR. There are 7 key principles that are the foundation of the GDPR, so what are they?

• Lawfulness, fairness and transparency
• Purpose limitation
• Data minimization
• Accuracy
• Storage limitation
• Integrity and confidentiality (security)
• Accountability

These principles are set out at the very beginning of the legislation and are the building blocks for the rest of it. They are what your Privacy Policy needs to be based on in order to ensure it is GDPR compliant. Let's take a look in a little more depth at each of these key principles.

1. Lawfulness, Fairness and Transparency

According to the GDPR “Personal data shall be:

"processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness, transparency’)”

Article 5.1(a) GDPR

You need to ensure you satisfy all three elements of this principle; lawfulness, fairness and transparency.

Lawfulness

What is meant by lawfulness in relation to the GDPR?

In order to satisfy the lawfulness aspect of this principle you must identify grounds for the processing of any personal data. There are 6 lawful basis's for processing personal data and at least one of these must be applicable when processing personal data. They are:

1. Consent: you have been given consent by the individual to process their personal data.
2. Contract: there is a contract in place with the individual and processing their personal data is necessary to fulfill this contract, or you have been instructed by the individual to process their data prior to entering into the contract.
3. Legal obligation: you must process the information in order to comply with the law.
4. Vital interests: you must process the personal data in order to protect an individuals life.
5. Public task: processing the personal data of an individual is a necessary component in performing a task in the public interest or for official functions of your company. This task must have a clear legal basis.
6. Legitimate interests: the processing of personal data is required in the legitimate interests of yours or a third parties, unless there is a reason to protect the individual, which overrides these interests.

Fairness

Fairness in relation to the GDPR means that you should only be processing and handling personal data in ways that the individual would expect. There should be no negative effects on the individual through your processing their personal data.

Another aspect of fairness is the way in which the information has been obtained from the individual. You must ensure that the individual is aware of why and how their personal data is being collected. If you have obtained the personal data through unjust means then this is unlikely to comply with the fairness aspect of this principle.

Transparency

What is meant by transparency in GDPR?

Being transparent means that you are being open, honest and clear about how you collect, use and manage individuals personal data. You must ensure you make this information easily accessible for your users as well as being written in clear and easily understood language. This information is part of your Privacy Policy which needs to be placed in an obvious place on your website in order for your users to see and read it.

To comply with the lawfulness, fairness and transparency principle you must:

1. identify a lawful reason for processing
2. identify a condition for processing either special category or criminal offense data
3. only use the personal data for lawful purposes
4. consider how the processing of personal data will impact the people who's data it is and be able to justify it if there is any negative impact on them
5. process personal data in expected ways or be able to explain why you are processing it for other reasons
6. are not deceptive or misleading in your collection of personal data
7. open and honest about the collection and use of personal data

2. Purpose Limitation

According to the second key principle of the GDPR "Personal data shall be:

"collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’);"

Article 5.1(b) GDPR

What this essentially means is that you must be clear about why you collect your users personal data and how you use it and if you use the personal data for another reason than originally specified, that it''s use is fair, lawful and transparent.

To ensure you are complying with the purpose limitation principle you will need to:

1. identify the purpose for processing
2. document the purpose
3. include details of reason for collecting personal data in your privacy policy
4. ensure that any personal data you plan to use for a new purpose is either compatible with the original purpose or make sure you get consent for the new purpose.

3. Data Minimization

The third key principle of the GDPR is data minimization. According to this principle, "personal data shall be":

"adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimization’);"

Article 5.1(c)

This means that you must collect the least amount of personal data to fulfill the purpose it is intended for. Holding more data than is required is unlawful and a breach of the data minimization principle.

To make sure you are complying with the data minimization principle you will need to:

1. collect personal data only when it is needed for a specific purpose
2. have only enough personal data to fulfill the purpose
3. review the data from time to time and delete any unnecessary data

4. Accuracy

The fourth key principle of the GDPR is accuracy. The accuracy principle states that "personal data shall be":

"accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);"

Article 5.1.(d) GDPR

The accuracy principle requires that you ensure the accuracy of any personal data you collect (within reason) and that this data remains valid and fit for purpose.

In order to comply with the accuracy principle you will need to:

1. ensure the accuracy of any personal data collected
2. update the data as required
3. keep records of any mistakes
4. comply with the right to rectification

5. Storage Limitation

The storage limitation principle is the fifth key principle of the GDPR. According to the storage limitation principle "personal data shall be":

"kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organizational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);"

Article 5.1.(e) GDPR

The fifth key principle means that you cannot hold data for longer than is required and you must be able to justify the reason for storing the data.

Personal data may be held for longer periods of time if you are keeping it for one of these reasons:

• public interest archiving
• scientific or historical research
• statistical purposes.

In order to comply with the storage limitation principle you will need to ensure that you:

1. know what personal data you hold
2. know why you hold this data
3. be able to justify the length of time you retain personal data
4. erase or make anonymous any personal data that is no longer required
5. have a process in place for requests to have personal data erased

6. Integrity and Confidentiality (security)

The sixth key principle in the GDPR is the Integrity and Confidentiality Principle, also known as the Security Principle. According to this principle, "personal data shall be":

"processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures (‘integrity and confidentiality’)."

Article 5.1.(f) GDPR

To ensure you are complying with the Integrity and Confidentiality Principle you need to:

1. determine the level of security that is required. This will depend on the type and amount of personal information being processed
2. you have a security policy and ensure that you follow it
3. have basic technical controls in place to reduce cyber attacks
4. use encryption when appropriate
5. understand the confidentiality, integrity and availability of the personal data you collect and process
6. ensure there is an appropriate back up process in place in the event that personal data is lost
7. conduct regular reviews of the security measures in place to ensure their efficacy and make adjustments to your procedures as required

7. Accountability

The accountability principle is the seventh key principle in the GDPR. According to Article 5.2 of the GDPR:

"The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’)."

Article 5.2 GDPR

There are two key points in the accountability principle and these are that you must be responsible and comply with the GDPR and you are required to demonstrate how you comply.

To demonstrate your compliance you will need to:

1. keep evidence of how you comply with the GDPR
2. ensure your Privacy Policy is GDPR compliant
3. have a data protection policy in place if applicable
4. use a data protection by design approach- implementing the best data protection methods throughout your processing operations
5. implement the appropriate security measures
6. record and report any personal data breaches if they occur
7. appoint a data protection officer if required

To ensure your business is GDPR compliant you are required to follow the above seven key principles and adhere to them as much as possible. We have provided you with what is required in order to be compliant with each of the principles. To ensure your Privacy Policy is compliant with the GDPR you can download our Professional Privacy Policy.