Teal blue graphic

ICO publishes guidance on GDPR

Last month the Information Commissioner’s Office (ICO) published details regarding its priorities on what guidance organisations can expect to receive about the General Data Protection Regulation (GDPR) and when they can expect to receive it.

Over the next 6 months the ICO will start to produce guidance for organisations in 3 phases.

Phase 1 

The ICO will build upon the “12 steps” guidance it published in March 2016 by focusing on identifying the key differences in the new legislation. The ICO intends to clarify specific provisions of the GDPR so that organisations are fully aware of its impact and to ensure that they can effectively implement the new requirements.

The ICO will focus on providing guidance on various key areas, which it believes require priority. These include individuals’ rights; contracts; consent; and a code of practice on privacy notices.

In addition, the ICO will contribute to key European level guidance based on the current Article 29 Working Party work plan.  Guidelines on matters such as identifying an organisation’s main establishment, data portability and the role of data protection officers are due to completed by the end of 2016.

The final part of Phase 1 is to carry out consultations and workshops to develop ICO policy outputs on a number of areas such as profiling, children's privacy and international transfers.

Phase 2

The second phase will focus on developing the new GDPR guidance structure and mapping the existing ICO content to the new structure. This will enable the ICO to identify and prioritise what new guidance needs to be created both before and after May 2018.

In addition, the ICO will seek to develop more practical tools to assist with compliance, particularly addressed at small and medium enterprises.

Phase 3

The final phase will be to finalise guidance and complete the development of any practical tools that have been introduced.  The ICO will signpost relevant European guidance or translate it into ICO guidance where appropriate.

This publication is intended for general guidance and represents our understanding of the relevant law and practice as at June 2016. Specific advice should be sought for specific cases. For more information see our terms & conditions.

Insights & events View all