The Data Protection Act 2018, which received Royal Assent on 23 May 2018, sets out how data protection law applies in the UK and widens the enforcement powers of the ICO that are not contained in the GDPR.

Most notably, the ICO has started consultation on its draft regulatory action policy, which sets out how it intends to use its enforcement powers. Importantly this document sets out the factors the ICO will look at if it discovers a breach or potential breach; including:

• Its nature and seriousness
• The types of personal data and number of individuals affected
• The costs of mitigating any risk, issue or harm

It appears that organisations which report their own potential failings or breaches will be considered favourably in the ICO’s application of fines against them.

For more information on any employment law matters contact Hannah Strawbridge on 01484 821300 or at hannahstrawbridge@eatonsmith.co.uk.