Presentation slides from the Wolters Kluwer GDPR Webinar. If you need help with GDPR visit us at www.wolterskluwer.co.uk/gdpr

1. GDPR Webinar
Alex Ayers
Head of Application Security
Nicholas Brown
Product Consultant
May 2018

2. Welcome to today’s Webinar
2
 We will be starting shortly at 12.00pm​
 The webinar will run for 1 hour​
 Submit your questions at any time during the webinar​
 We will have the Q&A at the end​
 This webinar is being recorded and will be circulated
tomorrow

3. Agenda
3
 GDPR Key Processes & Guidelines
 How Wolters Kluwer can help you and your clients with
GDPR compliance through our software
 Q&A

4. Wolters Kluwer
4

5. Poll 1
5
How far has your organisation progressed with your preparations for GDPR?
 Not started
 Currently implementing
 Nearly finished
 Completed
 Not sure

6. GDPR Recap
6
 Enhanced rights for Individuals
 Enhanced responsibilities for Controllers & Processors
 Enhanced penalties
 Opportunity to improve processes
 Opportunity to reduce operational risk

7. 5 Keys to Compliance
7
Engage & Train staff
KYD (Know Your Data)
Ensure appropriate security
Implement appropriate governance
Operate
SPRINT
MARATHON

8. Data Inventory
8
 What data you are collecting
 Why you are collecting the data
 When the data is no longer required
 How you are collecting the data
 Where the data is stored and processed
 Who you are sharing data with
I keep six honest serving-men (They taught me all I knew); Their names are What and
Why and When and How and Where and Who. - Kipling

9. Lawful Basis for Processing
9
 Identify bases for processing
 Update privacy notice
 Understand the obligations and limitations for choses bases
 Ensure engagement letters allow communications
 Opt-out
Silence is sometimes an argument of Consent – Thomas Hobbes

10. Data Retention
10
 Identify retention periods for all personal data
 Leverage legal and (EEA) industry guidelines
 Consider anonymisation
 Ensure policy is consistently applied
Personal data processed for any purpose or purposes shall not be kept for longer than is
necessary for that purpose or those purposes. – ICO / GDPR Article 5 (e)

11. Poll 2
11
Do you have a formal data retention policy within your practice?
 Yes
 No
 Not sure

12. Poll 3
12
Is your data retention policy implementation consistent?
 Yes
 No
 Not sure

13. Data Privacy by Design & Default
13
 Privacy Impact Assessment (PIA)
 Perform Due Diligence
 Implement common sense controls
 Embed privacy requirements into projects and operational activities
 Policy & Processes  Practices
All human beings have three lives: public, private, and secret.” - Gabriel Márquez

14. Access Requests
14
 Nominate a coordinator / Privacy Champion
 Develop a response process
 Identify roles & responsibilities
 Use the data mapping to identify systems
 Ensure that identity verification is proportionate
I want it all and I want it now – Queen

15. Breach Management
15
 Have a plan
 Identify what is a notifiable event
 Ensure team know their roles
 Ensure that contracts with processors have notification clauses
 Maintain a breach register
Captain, we have a problem - various

16. Poll 4
What percentage of your clients would you estimate are prepared for
GDPR?
 0-25%
 25-50%
 50-75%
 75-100%
 Not sure
16

17. CCH Central is GDPR
compliant and ready......
Nicholas Brown

18. 18
CCH Central
GDPR
 Capturing and recording Consent
 Personal Data
 Information access requests
 The right to data portability
 Audit Trail
 The right to be forgotten (erasure)
 Data retention
 Permissions

19. Capturing and recording consent
GDPR requires that all users provide explicit consent to track personal
information.
CCH Central offers the necessary functionality for the Practice to store the
consent from the clients whose data they want to use and/or share.
19

20. Capturing and recording consent
 GDPR Consents added to Extra fields
20

21. Capturing and recording consent
21
 Extra fields with GDPR Consents marked with a new icon

22. Capturing and recording consent
 New Consents Tab
22

23. Capturing and recording consent
23
The history of changes made to the consents grid is recorded in the Audit Trail

24. Capturing and recording consent
24
 New report fields available for Consents

25. Personal Data
Personal data is classed as any information relating to an identifiable natural
person.
This includes a broad range of data including: name, number , location, online
ID, physical, physiological, genetic, mental, economic, cultural and social data.
25

26. Personal Data
26

27. Personal Data
27

28. Information access requests
CCH Central has a single routine to select the data you wish to include ion
your response.
This will be saved in a PDF format or other human readable format so it can
be provided to the individual making the request.
Allows the export of files in standard formats: PDF and XML.
28

29. The right to Data Portability
Data portability, in accordance with the GDPR, is the right for an individual to
require an organisation to give them back a copy of the personal data they
previously provided or, to send this data to another organisation.
Users may request access to any information companies possess relating to
them like information about their Tax Returns or Accounting Periods.
CCH Central allows the export of files in standard formats: PDF and XML.
29

30. Subject Access Request
30

31. GDPR – Subject Access Request
31
 Central: Personal Data option is by
default selected. A PDF file that
contains personal information about
the client or contact like name, date of
birth, address, associated contacts, etc,
will be generated.
 Personal Tax/Trust Tax: Current Year
and Prior Years are available on Clients
with the following Contact Types: Other
Person, Trust, Partnership and LLP.
 Accounts Production is not available in
the 2018.1 (April) release

32. Audit Trail
32

33. 2018.2 May GDPR Central Release
 The key enhancement is the functionality to address Erasure or the “right
to be forgotten”
 Data portability of Accounts Production
 Data Retention
 Permissions
33

34. External Communications
 CCH OneClick – our client portal solution
 CCH Document Management
34

35. Content to help you
35
gdpr.wolterskluwer.co.uk
Quiz Accounts’ Guide SME Guide

36. Software to help you
36
wolterskluwer.co.uk/gdpr

37. Any questions?Any questions?
37

38. Thank you