In an industry such as construction, the core of firms’ business is not concerned with processing customer data.  However, the new General Data Protection Regulation (GDPR) gives individuals the right to sue anyone who holds their data and fails to deal with it properly – and almost all companies hold such personal information. 

In the construction industry, the obvious example is information about a company’s own employees but it will inevitably go further. Any construction project may involve a raft of personnel (both employees and subcontractors) carrying site access cards bearing some personal data. CCTV will capture footage of individuals on site. Smart technologies that log personal data in increasingly sophisticated, and often unexpected, ways are being deployed. Failure to comply with GDPR can lead to serious consequences.

GDPR represents a major shift in UK data protection law. Its 99 articles increase data protection rights for individuals, increase obligations on data controllers (who determine how and why personal data is processed) and, for the first time, impose obligations directly on data processors (the entities actually obtaining, recording, adapting or holding it on the controller’s behalf).

…