We use cookies to ensure that we give you the best experience on our website. If you continue without changing your settings, we will assume that you are happy to receive all cookies on the Business Car website. However, if you would like to, you can change your cookies at any time
The start point for the best source of fleet information |
Many businesses within the fleet industry are unprepared for the introduction of the General Data Protection Regulation (GDPR).
That's according to fleet management service provider Fleet Operations.
The GDPR comes into force on 25 May this year and requires businesses to comply with a new set of rules designed to safeguard personal data.
One of the changes means organisations will now take responsibility for data protection breaches at any point within the supply chain.
Fleet Operations says this puts fleet suppliers and operators at particularly high risk due to the large amount of personal data transactions that occur within the fleet supply chain.
Brian Hardwick, head of operations at Fleet Operations, believes too few companies have got to grips with the full extent of their responsibilities under the new rules.
He said: "From our experience, it appears many organisations still have not assessed the full impact of the GDPR and taken the requisite action to ensure they will be compliant.
"There exists a perception that this is a minor adjustment when, in fact, businesses need to assess their entire supply chain to ensure each link is secure.
"As a starting point, it is vital for organisations to map all data flows across the business, which means documenting all data coming in and going out, as well as the various organisations or individuals that process information at each point in the supply chain.
"Contracts must now be in place between the data controller and data processor in each of these data transactions covering all the requisite details outlined by the GDPR."
The maximum fine for GDPR breaches is ?20 million or 4% of turnover, whichever is greater.
Hardwick added: "It is not sufficient for an organisation to simply hand all responsibility for the GDPR to a designated data controller - everyone should bear some of the burden.
"There are obvious data streams, such as payroll, but there are less obvious ones that include everyday emails.
"In this context, a breach could occur due to something as simple as copying someone into an email thread that contains data they do not have consent to view.
"That's why it is important to communicate the new regulation - and the steps you are taking to address it - very clearly to all staff and put data protection at the centre of your organisational culture."
BusinessCar magazine ©2019
Business Car Magazine © 2020 | Business Car is part of NS Media Group.
