Our purpose is to give legal and data protection advice, training and support to enable the business to achieve its goals and make the best risk-based commercial decisions.
- Monitor Greene King’s compliance with data protection law (primarily the UK Data Protection Act, UK General Data Protection Regulation and the UK Privacy and Electronic Communications Regulations), the statutory codes issued by the Information Commissioner and relevant policies which Greene King puts in place
- Assist the data protection manager with conducting data protection impact assessments
- Conducting transfer risk assessments
- Manage, classify and respond to data incidents, in particular, recommending to the Data Protection Officer how to respond to the risk data incidents pose to data subjects and to the business. Also to log actions taken, outcomes, consider mitigating controls and determining what improvements can be made to prevent reoccurrences
- Assist the Data Protection Officer in cooperating with the Information Commissioner in respect of any enquiries it makes in connection with its role as the UK data protection regulator
- Keeping records to evidence compliance with various of the statutory record keeping requirements set out in the UK GDPR e.g. records of processing activities (RoPA), records relating to data subject rights-related requests, records relating to data incidents and personal data breaches
- Drafting internal data protection policies and privacy notices
- Assist the data protection manager with establishing processes for managing data protection risks during project delivery and business-as-usual activities e.g. RFP, project management
- Work with the data protection manager to ensure data protection is a key consideration in governance forums throughout the business
- Provide assistance and advice during vendor/supplier selection activities from a data protection perspective
In respect of data subjects:
- Ensuring that data subject’s rights-related requests are dealt with correctly and in a timely fashion
- Corresponding with data subjects by telephone and email to acknowledge and respond to their data protection rights requests