Session Overview

Welcome to today’s GDPR refresher session. This short but crucial session will focus on strengthening our data protection practices, particularly around email security and handling sensitive information.

Key GDPR Principles

1. Lawful Processing: Personal data must be processed lawfully, fairly, and transparently.
2. Purpose Limitation: Data should only be used for its intended and legitimate purpose.
3. Data Security: Personal data must be securely stored and transmitted to prevent unauthorised access.
4. Accountability: We are all responsible for ensuring GDPR compliance in our roles.

Common Mistakes and How to Avoid Them

• Using Personal Emails:
  
  • Always use approved company email systems (e.g., nhs.net) for sending sensitive data.
  • Never send business-related sensitive data to or from personal email accounts.
• Recipient Errors:
  
  • Double-check recipient addresses before sending, especially when using autocomplete.
  • Verify external contacts carefully to ensure they are authorised recipients.
• Unsecured Data Transfers:
  
  • Encrypt files before sharing if they contain personal or sensitive data.
  • Use password-protected documents where necessary.

Secure Communication Best Practices

1. Before Sending an Email:
   
   • Confirm the recipient’s email address.
   • Assess if sending the data is necessary or if a secure alternative exists.
   • Use encrypted methods when sharing sensitive files.
2. If a Mistake Occurs:
   
   • Contact the recipient immediately to request deletion.
   • Report the incident to the Data Protection Officer (DPO) without delay.
   • Document the incident and corrective actions taken.

Email Template for Reporting Misaddressed Emails

If you have mistakenly sent an email containing sensitive information to the wrong recipient, please use the following email template to request its deletion. Do not reply to the original email, as this may create additional copies of the sensitive data. Instead, create a new email.

Subject: Urgent: Request for Email Deletion

Dear [Recipient’s Name],

I am writing to inform you that an email containing sensitive information was inadvertently sent to your email address in error. To ensure compliance with data protection regulations, I kindly request that you take the following immediate actions:

1. Please delete the email from your inbox.

2. Ensure the email is also removed from your deleted items/trash folder.

3. Respond to this email confirming that the requested actions have been completed.

I sincerely apologise for any inconvenience caused and appreciate your cooperation in helping to ensure data security.

Thank you for your prompt attention to this matter.

Best regards,
[Your Name]
[Your Contact Information]

Contact Information

For any questions or to report an incident, please contact:
Data Protection Officer (DPO): jan@hunrosa.co.uk

Let’s work together to ensure we maintain the highest standards of data protection and security.