The latest in a long line of legislation introduced courtesy of the UK’s fading love affair with the European Union hits the statute books this month. The Data Protection Act has been in force since 1998, the same year that Andorran opened its doors, Google was launched and Arsene Wenger’s Arsenal won the league and cup double. A good year then!

Andorran and Arsene are still going strong and Google is part of our daily lives, but the rulemakers have decided that the Data Protection Act is no longer fit for purpose. It is to be replaced by the General Data Protection Regulation or GDPR for short.

Intended to protect our personal data
It is intended, of course, to protect our personal data and we all hope that it helps to eliminate some of the major data losses suffered in the well-documented cases involving some very public names, most recently, of course, Facebook and Cambridge Analytica.

I fear, however, that it is the proverbial sledgehammer and nut scenario. The effect of compliance on small businesses will be horrendous and well out of proportion with the benefits it will bring. No small business is immune from the possibility of data loss, but it’s hard to imagine how it could ever be on the same scale as those widely-publicised events.

We will all update our systems to comply, as best we can, with GDPR. Actually it’s been quite an interesting exercise to review our policies and procedures for storage of information, both online and on paper, for, don’t be fooled, GDPR applies equally to hard copy as to electronic data.

A culture change for professional firms
The perceived wisdom is to hold data for no longer than you are obliged to, which is a culture change for many professional firms, including mine, who see data retention as part of the ability to deliver client service. Just a fortnight ago, a client asked for his tax returns going back to 2001, which I was able to provide, because historically we have kept everything. He was delighted to find I could help him; it was a good job he didn’t wait until next month to ask, when I might well have destroyed it if I follow this perceived wisdom.

If you’re running a business don’t ignore GDPR. You will need to adapt some of your business practices and update others, otherwise you risk an enquiry from the Information Commissioner’s Office and some potentially hefty fines.

You have been warned!