UK GDPR: What MSPs need to know

Max Pruger at Kaseya shares advice on ensuring compliance with the UK’s version of the GDPR

Brexit brought about multiple changes in working practices for SMEs, both in the UK and across the globe, including updates around how data should be collected and processed.

On January 1, 2021, the UK released its own version of the European Union’s (EU) General Data Protection Regulation (GDPR), which applies to organisations that target, process or store electronic data from UK citizens, regardless of where the organisation is located.

The UK regulation was largely based on the original EU GDPR, but included several changes in key areas of the law around national security, intelligence services and immigration. Though the EU and UK GDPR regulations have many similarities, the fact there are now two regulations provides added complexity for SMEs - especially for organisations that need to comply with both.

While it has been little over a year since UK GDPR went into effect, many IT managed service providers (MSPs) and SMEs are still adjusting to the new requirements. Through 2022 and beyond, MSPs should keep three tips in mind as they help their clients navigate the UK GDPR regulation.

The importance of regular documentation

The first consideration is that MSPs must educate clients on the importance of regular documentation that will provide evidence of compliance.

Though the UK GDPR regulation has not, so far, resulted in eye-popping fines the way EU GDPR has, there are still significant consequences for non-compliance - with penalties as high as £17.5 million in some cases. And while large fines tend to gain the most attention, the vast majority of fines tend to be imposed on smaller organisations and even individuals.

Without evidence of compliance, even organisations that meet all requirements can face financial penalties that could, in many cases, cripple their businesses.

To prevent a nightmare scenario from occurring, MSPs need to focus on documenting all requirements for their clients and working closely with them to put procedures in place to ensure documentation is done regularly and accurately.

MSPs will need to educate their customers on what constitutes evidence of compliance and reassure them that the time and money spent putting these processes in place will save them from significant fines later on.

Automated solutions are critical

The second thing to bear in mind is that automated solutions are critical—especially for organisations handling both UK and EU GDPR requirements.

While automation is not a new priority for MSPs, those that wish to build their compliance-as-a-service business will need to invest in automated tools in 2022 to increase their profitability. These tools are especially critical for MSPs managing clients that must comply with both UK and EU GDPR requirements.

When assessing automated compliance solutions, MSPs should prioritise solutions that automate the production of reports, manage the manual collection of required information and provide ongoing remediation documentation. A checklist product is not enough. MSPs need to look for solutions that streamline the process for providing evidence of compliance.

In addition to educating their customers about the importance of documentation, MSPs should also empower their clients by stressing to them the value of using these automated documentation tools to save the time and headache that often occurs with compliance processes.

These automated compliance solutions can simplify project management activities for both parties by providing built-in notifications and task lists.

Keep up to date with changes to the UK GDPR

The third consideration is that 2022 may bring significant changes to UK GDPR. MSPs must stay informed about these.

The UK government put out a consultation on September 10 seeking comment on various aspects in the current UK GDPR regulation, including research-specific provisions, data transfer mechanisms and AI and machine learning data.

Though some of these changes are not likely to affect MSPs, the biggest shift could come if the UK loses its adequacy status with the EU, which could make data transfer between the UK and other EU countries significantly more complex.

The UK government has not finalised the timeline for these changes, but MSPs will need to follow the news closely over the next several months to ensure that both they and their clients remain compliant.

Though UK GDPR will continue to evolve in 2022, MSPs have a great opportunity to increase their profit margins and take some of the burden of compliance off their customers’ plates by offering compliance-as-a-service for UK GDPR.

Those MSPs that prioritise automated compliance solutions and work to truly educate their customers on the complexities of the regulation stand to gain the most in 2022 and beyond.

Max Pruger is GM, Compliance Manager GRC at Kaseya. For more information on how your MSP can grow its UK GDPR compliance-as-service business, visit Kaseya.com.

Main image courtesy of iStockPhoto.com