GDPR

As of 25 May 2018, European data protection legislation will be updated for the first time in 20 years. The EU General Data Protection Regulation (GDPR) replaces the 1995 EU Data Protection Directive. The GDPR strengthens the rights that individuals have regarding their personal data and seeks to harmonize data protection laws across Europe, regardless of where that data is processed.

You can rest assured that One Beyond is committed to GDPR compliance. We are also committed to helping our customers comply with the GDPR by providing stringent privacy and security protections that are built into our service and contracts.

What are your responsibilities as a data controller?

One Beyond customers will typically act as the ‘data controller’ for any personal data they provide to One Beyond in connection with their use of One Beyond’s services. The data controller determines the purposes and means of processing personal data, while the data processor processes data on behalf of the data controller.  One Beyond is a ‘data processor’ and processes personal data on behalf of the data controller when it uses One Beyond’s services.

Data controllers and data processors are responsible for implementing appropriate technical and organisational measures to ensure and demonstrate that any data processing is performed in compliance with the GDPR.  Their obligations arise from the data protection principles which require lawfulness, fairness and transparency, purpose limitation, data minimisation, and accuracy, as well as fulfilling data subjects’ rights with respect to their data.

If you are a data controller, you will find guidance on your responsibilities under GDPR by regularly checking the website of your national or lead data protection authority.  In the case of the UK, this is the Information Commissioner’s Office at ico.org.uk.

You should also seek independent legal advice relating to your status and obligations under the GDPR, for legal advice specifically tailored to your situation.  Please bear in mind that nothing on this website is intended to provide you with, or should be used as a substitute for, such legal advice.

Where should you start?

Now is the time for you to begin preparing for the GDPR and we are here to help. Here are some considerations:

  • Firstly, familiarize yourself with the provisions of the GDPR, especially the changes that it will make to your current data protection obligations.
  • Consider creating an updated inventory of personal data that you handle. One Beyond can help identify and classify your data.
  • Review your current controls, policies, and processes to assess whether they meet the requirements of the GDPR. If not, build a plan to address any areas that need amending.
  • Monitor updated regulatory guidance as it becomes available.
  • Consult a lawyer to obtain legal advice specifically applicable to your business circumstances.

Our commitments to the GDPR

Alongside other duties, data controllers are required to only use data processors that provide adequate guarantees as to appropriate technical and organisational measures so that data processing will meet the requirements of the GDPR. Here are some aspects you may want to consider when conducting your assessment of One Beyond:

  • EXPERT KNOWLEDGE – One Beyond employs and works with security and privacy professionals to maintain its systems, develop security review processes, build security infrastructure, and implement security policies. Its teams engage with customers, industry stakeholders, and supervisory authorities to shape its services in a manner that helps customers meet their compliance needs.
  • OUR POLICIES – One Beyond’s data processing agreements clearly articulate its privacy commitments to customers. The terms have been amended over the years to reflect feedback from customers and regulators. We plan on specifically updating our terms to reflect the GDPR, and will make these updates available in advance of the GDPR coming into force to facilitate our customers’ compliance assessment and GDPR readiness when using One Beyond’s services. The updated terms will take effect from 25 May 2018, when the GDPR comes into force.
  • FUNCTIONALITY – We have verified that our hosting facilities have all of the necessary functionality for compliance with the GDPR – not least because they are based in the United Kingdom. In addition, the method we use for deletion and retention of data is acceptable under the GDPR. This verifies to our customers they are using software that is going to keep them compliant when 25 May 2018 comes around.
  • DATA PROCESSING – We promise to maintain a high level of security, and will ensure timely breach reporting to meet all GDPR expectations. To reflect this, we utilise a number of security features through our hosting partners, Rackspace and Azure including WAF, IDS and Log storage. Our security practices also include breach detection and timely notification and then recovery. We’ve purchased this protection on behalf of all of our customers. It’s incumbent upon each data controller to ensure that its data processors have the right infrastructure in place to process personal data.
  • PROCESSING ACCORDING TO INSTRUCTIONS – Any data that a customer and its users put into our systems will only be processed in accordance with the customer’s instructions.
  • EMPLOYEE CONFIDENTIALITY – All of One Beyond’s employees are required to sign a confidentiality agreement and complete mandatory confidentiality and privacy training.
  • USE OF SUBPROCESSORS – One Beyond directly conducts all data processing activities required to provide its services other than storage. Its hosting partners, Rackspace and Azure, who stores the data for us holds all the necessary and expected security accreditations.
  • DATA RETURN & DELETION – Where your app’s features do not include automatic deletion of data, One Beyond’s helpdesk will delete and/or export (return) data at any time during the term of our service agreement. One Beyond/Rackspace/Azure stores data backups for two weeks before the backups are replaced fully and any old data is removed.
  • DATA CONTROLLERS – How One Beyond assists data controllers:
    Data Subject’s Rights – One Beyond can provide an export of customer data, at any time during the term of the agreement.
    Data Protection Officer – The One Beyond Data Protection Officer is Nick Thompson. Any questions can be directed to him regarding data protection concerns.
    Incident Notifications – One Beyond will provide contractual commitments around incident notification. We will continue to promptly inform you of incidents involving your customer data in line with the data incident terms in our current agreements and the updated terms that will apply from 25 May 2018, when the GDPR comes into force.
    Certifications – Our customers and regulators expect independent verification of security, privacy, and compliance controls. One Beyond carries current ISO 27001 and Cyber Essentials Plus certifications.

  • STANDARDS & CERTIFICATIONS Our customers and regulators expect independent verification of security, privacy, and compliance controls. One Beyond carries current ISO 27001 and Cyber Essentials Plus certifications. One Beyond has been independently audited, and meets the requirements for BS EN ISO 27001:2013 registration. The scope covers how we manage information security in providing services to our customers.