With a wealth of experience working with life sciences and healthcare providers, we understand your specialist data privacy needs.
This all-encompassing service fulfils your DPO responsibilities wherever you are based in the world, and ensures compliance with the EU GDPR, UK GDPR, DPA 2018 and HIPAA, as appropriate.
What does this service cover?
This is a dedicated, independent DPO service that provides advice on:
- Monitoring your data privacy compliance requirements;
- Reviewing privacy compliance documentation, including drafting new documents;
- Third-party supplier contracts, including master service agreements, CRO agreements, site agreements and data sharing agreements;
- Consent management;
- Cross-border data transfers;
- The need to conduct DPIAs (data protection impact assessments) – including DPIAs relating to the storage of research and clinical trial data, and general DPIAs – and the manner of implementation, as well as any required outcomes of the DPIAs;
- Data breach monitoring and management, and the requirement to report or record including specific data breach reporting requirements relating to CROs and/or required by health regulators and supervisory authorities;
- Responding to data privacy rights requests from individuals;
- Staff awareness training; and
- Information collection.
It also includes:
- A gap analysis to assess your current state of compliance and a remedial action plan that identifies and prioritises key issues your organisation must address to comply with the EU GDPR, UK GDPR, DPA 2018 and HIPAA, as appropriate;
- Acting as the contact point for data protection authorities for all data protection issues;
- Unlimited telephone and email advice within UK business hours via your dedicated GRCI Law DPO consultant;
- Provision of an EU or UK representative service, if required;
- Overseeing the creation and maintenance of the personal data processing register (the Article 30 record);
- Regular reporting for senior management;
- A monthly newsletter on important data privacy updates; and
- An annual compliance audit (from year two).
Download the full service description
Conditions
- Support is available during UK business hours Monday to Friday, 9:00 am – 5:00 pm.
- Suitable for organisations in the life sciences and healthcare sectors where a DPO is required.
Why outsource your DPO to GRCI Law?
We only advise on data protection, privacy, and cyber and information security, which means our team has the knowledge, experience, and visibility of the latest trends, best practice, developments and challenges.
With a number of life sciences and healthcare clients, we have a wealth of experience in these sectors. We understand the highly regulated nature of these clients and the specialist data privacy needs applicable.
Our clients view us as part of their teams and we are known for our pragmatic, commercial advice. We won’t just identify an issue or advise on the law – we provide you with a practical solution to suit your specific needs.
- Access to a team of expert DPOs and lawyers.
- Cost savings in recruitment, employment and retention – finding an experienced DPO with the right skill set and experience can be time-consuming and expensive.
- A service that is flexible to your organisation’s needs, with pricing to match.
- Sector-specific experience.
What are the requirements of the DPO role?
- Review and provide guidance on privacy policies, procedures and documentation relating to the processing of personal data – GDPR Article 39(1)(a).
- Oversee the establishment and maintenance of the personal data processing register (the Article 30 record) – GDPR Article 39(1)(a).
- Advise on the necessity for a DPIA, the manner of its implementation and outcomes – GDPR Article 39(1)(c).
- Provide guidance on data breach monitoring, management and reporting – GDPR Article 39(1)(a).
- Serve as the contact point for data protection authorities for all data protection issues – GDPR Article 39(1)(d) and (e).
- Provide advice and guidance on responses to privacy rights requests from individuals (information, access, rectification, objection, erasure, data portability) – GDPR Article 38(4).
- Facilitate GDPR awareness training and the training of staff involved in data processing operations.
- Monitor compliance with the GDPR – GDPR Article 39(1)(b).
Need more information?
For more information about this service or to get a tailored quote, please enquire below and one of our experts will be in touch shortly.
