GDPR Week #16 - Show Your Workings

If you're grappling with ensuring your organisation comes to terms with the customer experience-related requirements of the GDPR and new Data Protection Act and have been following the advice in these weekly blogs, then by now you have probably had lots of conversations, filled a few white boards and even changed some processes and customer journeys.
That's great. And unless you were impressively well-prepared in advance, or maybe work for an organisation that has a very simple customer interaction business model there will be more to come. Added to which, as you adopt - or are already following - the Information Commissioner's Office (ICO) guidance around following a 'privacy by design' approach, there will be documentation, notes and explanations of the data privacy impacts of your future developments and changes.
In which case, you need to record what you thought & why and how that thinking brought you to the conclusions you reached. That's because the ICO expects organisations to follow their guidance on Accountability and Governance (www.ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/), which includes documenting and explaining the rationale for your processing activities.
This information may be invaluable when communicating with customers and business partners and clients - and the ICO, should they ever decide to call by!