General Data Protection Regulation GDPR Implementation Project Overview

General Data Protection Regulation (GDPR) Implementation Project Overview of Structure July 2017

GDPR Implementation Project: Governance GDPR Strategic Decision Making Board Project Sponsor Margaret Lee Director for Digital Head of Internal Audit Monitoring Officer Data Protection Officer Head of Legal Services Head of Corporate Services Caldicott Guardian (Childrens) Caldicott Guardian (Adults) Project Manager Scott Sammons GDPR Operational Project Team Data Protection Officer IG Operations Lead Records Manager IG Officer (Data Sharing) Audit Manager HR Representation Employee Comms Deputy County Solicitor Head of IT Security Head of Business Support Adult Social Care Operations Children's Social Care Operations Finance Representation Head of Payroll Commercial & Procurement Manager

GDPR Implementation Project: Workstreams & Deliverables 1. Governance Deliverables: 1. Revised policy & procedures 2. Revised PIA process 3. Agreed risk approach 4. Data Protection Officer 2. Assurance Deliverables: 1. Internal Assurance regime 2. External Assurance regime 6. Rights 7. Security Deliverables: 1. Revised complaints process 2. Revised process & resources for SARs & FOIs 3. Agreed Data Portability process Deliverables: 1. Incident Process 2. Agreed process on encryption standards 3. Documented security controls 4. Documented Integrity controls 5. Documented Availability controls 3. Third Party Management Deliverables: 1. List of 3 rd parties by priority 2. Develop & implement standard contract terms 3. Revise Data Sharing Frameworks 8. Systems & Technology Deliverables: 1. Required system changes 2. Data Portability setup 3. Anonymisation standards 4. Collection & Use Deliverables: 1. Privacy Notices 2. Website privacy policy 3. Consent management 4. ROPA 9. Training & Awareness Deliverables: 1. Training of DPO/Key roles 2. Ongoing project team awareness 3. Ongoing key messages to all ECC 4. All staff training programme post project 5. Retention & Destruction Deliverables: 1. Agreed and published retention periods 2. Process for managing & monitoring retention periods 3. Agreed process for destruction of appropriate data 10. Staff Data Deliverables: 1. Changes to staff contracts / Notices 2. Process for rights management

GDPR Implementation Project: Timeline 2017 Jan 1. Governance 2. Assurance 3. Third Parties 4. Collection & Use 5. Retention 6. Rights 7. Security 8. Systems & Tech 9. Training 10. Staff Data 2018 Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec Jan Feb Mar Apr May +

GDPR Implementation Project: 2. Timeline 2017 Jan Feb Key Milestone: Initial Awareness Campaign Launched Mar Apr May Jun Key Milestone: Completion of Data Inventory Key Milestone: Revised complaints process Key Milestone: Data Portability Requirements defined Key Milestone: Internal Assurance Regime agreed Key Milestone: Risk Management Approach Agreed Key Milestone: Key role training programme agreed Key Milestone: Interim DPO role agreed & implemented

GDPR Implementation Project: Timeline Jul Aug Sep Key Milestone: List of high priority contracts / DS agreements Oct Key Milestone: Deployment of ROPA Database Key Milestone: Deployment of incident process Key Milestone: All employee training programme agreed Key Milestone: Revised PIA process implemented Key Milestone: Incident response process agreed Key Milestone: External Assurance Regime agreed Key Milestone: Retention periods & policy agreed Key Milestone: Agreed Anonymisation standards Nov Dec Key Milestone: GDPR DPO role agreed & implemented Key Milestone: Changes to website complete Key Milestone: Agreed Data Portability Process Key Milestone: Encryption standards in place Key Milestone: Revised policies and procedures in place Key Milestone: Security & Integrity Controls documented Key Milestone: Website privacy policy changes agreed Key Milestone: Employee data changes made Key Milestone: Notice & Consent management agreed

GDPR Implementation Project: Timeline 2018 Jan Key Milestone: All staff training programme deployed Key Milestone: GDPR DPO role agreed & implemented Feb Key Milestone: SAR & FOI process & resources deployed Key Milestone: Data Portability process deployed Mar Apr May Key Milestone: Governance Framework fully deployed Key Milestone: Standard Contract Terms Agreed Key Milestone: Accepted level of third parties on new terms Key Milestone: Assurance programme deployed Key Milestone: Retention and Destruction programme deployed Key Milestone: All high risk system changes now in place Key Milestone: Completion of project awareness campaign +