Step 6 of 12 steps to GDPR compliance in 12 posts


This is Step 6 in our series of emails designed to help you get ready for GDPR. If you have missed any in the Series and would like to catch up, please email visit 12 Steps to GDPR on our website.

The 25th of May is not very far away now and non-compliance can result in significant penalties. If you follow the practical steps in our series of emails, you should be getting into good shape but, if you need someone by your side to get you over the line, we are here to help.


You should identify the lawful basis for your processing activity in the GDPR, document it and update your privacy notice to explain it. Many organisations will not have thought about their lawful basis for
processing personal data.

  • Under the GDPR some individuals’ rights will be modified depending on your lawful basis for processing their personal data.
  • The lawful bases in the GDPR are broadly the same as the conditions for processing in the DPA.
  • The most obvious example of difference is that people will have a stronger right to have their data deleted where you use consent as your lawful basis for processing.
  • You should document your lawful bases in order to help you comply with the GDPR’s ‘accountability’ requirements.

We are here to help

Qubic can work alongside you to help you meet the conditions laid out by the Information Commissioner’s Office for compliance with the new legislation. We have a team with expert knowledge, experience and technology to help your organisation be ready for GDPR on 25 May – but that’s not very far away now.

You can’t afford to wait any longer – contact Qubic today on 020 8601 7000 and we can help you work towards compliance. Even the longest journey starts with the first step…