Welcome to November’s edition of the iSTORM Data Protection Newsletter. Read on to discover the latest news from the world of data protection, along with updates on everything happening at iSTORM.
iSTORM Updates
October was another busy month for the iSTORM team, with ongoing client projects continuing alongside new enquiries and proposals for support across GDPR, Penetration Testing, Cyber Essentials, and ISO services implementation and audit.
It was also a particularly exciting month in the world of ISO! Following months of work on a four-way IMS incorporating ISO 42001 (AI), we’re delighted to share that iSTORM has successfully supported a client in achieving ISO 42001 certification, becoming one of few UK organisations to achieve this certification.
Alongside this, our amazing Data Protection team has been busy supporting clients with a wide range of projects and ongoing compliance activities, including scheduling and conducting client audits, reviewing, monitoring and managing GDPR frameworks and ISO management systems. We also supported client committee meetings to strengthen accountability and delivering Information Governance training to a major transport development company, and assisted a large council with the management of its Information Asset Register, while continuing to provide support with its DSAR processes, and also attended client site visits and participating in Business Continuity Planning (BCP) tabletop exercises, providing practical guidance to help organisations prepare for potential disruptions.
In addition, the team also undertook additional ePrivacy and cookie compliance training to further strengthen the advice and support we provide to clients.
It’s been a busy and rewarding month, and we’re looking forward to continuing this work as we head towards the end of the year.
When was the last time you checked your GDPR compliance?
There are a considerable amount of policy and procedural documents that are required under the GDPR, of which an audit schedule plan must be in place and the DPO should review changes to relevant policies prior to release to the business. There is also an expectation under the GDPR to maintain, review and keep up to date compliancy areas such as:
- Record of Processing Activity
- Legal Register and Interested Parties
- Assets and Supplier Lists
- Privacy Notices (Customer, Employee and Recruitment) and Cookie Notice.
- DSAR Log
- Incident Log
- Training Log and Materials
- Retention Schedules
- Policy and procedural reviews.
Let us support you: Take a look at your records, logs, trackers and policies. When were they last reviewed? Are they complete? Are they still accurate? Have things slipped because day-to-day work has taken priority?
Let us review what you have. Let’s create what you’re missing. Let’s fix what’s no longer working. Don’t just have iSTORM on paper. Have us with you.
Get in touch today to find out how we can support your organisation with its ongoing data protection requirements.
Latest Threat Intelligence Report
The cyber threat landscape is constantly evolving. Our latest Threat Intelligence Report explores current security risks, emerging threats, known threat actors and recent cyber incidents, highlighting what organisations need to be aware of.
Stay informed and understand the risks facing your organisation.
News
Xandr fined over unlawful sharing of Grindr users’ data
Norway’s data protection authority has fined advertising company Xandr NOK 92 million (approximately £7.3 million) for unlawfully processing and sharing Grindr users’ data, including information about sexual orientation. The case highlights the importance of verifying valid consent and ensuring personal data, particularly sensitive information, is handled appropriately throughout advertising supply chains. Source: PDP
Ten NHS staff removed from duty over alleged patient-record snooping
Ten employees of East Suffolk and North Essex NHS Foundation Trust have been removed from active duty or suspended amid concerns that they accessed the digital medical records of three year old Noah Woods without a legitimate clinical reason. The Trust has secured the records, launched an urgent investigation, apologised to Noah’s family and reported the incident to the ICO. Source: PDP
Training
Did you know it’s a legal requirement to ensure all employees and contractors are trained to handle personal data? From GDPR principles to breach response, data requests, and remote working, it’s your responsibility, and you must be able to evidence it.
iSTORM can help with bespoke training in any format: HR packs, team sessions, in-person workshops, or even voice-over training for your internal LLM. Don’t get caught out—proper training is the first thing regulators will ask for if something goes wrong.
Talk to us about what support we can provide!
Meet the Team…
Our friendly team of passionate Data Protection Specialists are here to help your team navigate your data protection challenges, and are happy to support you with all your queries.
More from iSTORM?
We can offer services including:
- GDPR/ Data Protection gap analysis and maturity reviews
- Auditing
- GDPR framework implementation support
- Outsourced Data Protection Officer Services (DPO)
- Data Protection Impact Assessments (Review & Completion)
- Data Flow Mapping
- Supplier Assurance Frameworks
- Policy and procedure writing
- Training and awareness (online and face to face)
We hope you have enjoyed this months data protection news roundup. For more information on any of the above, please email us at info@istormsolutions.co.uk or call +44 (0) 1789 608708.
