BS 10012
As legal requirements such as the European Data Protection Regulation (EU GDPR) are developed and enforced, businesses need to demonstrate that they take managing privacy seriously. BS 10012 has been produced for exactly this reason.
How do I get BS 10012?
Don’t be put off by thinking it is too complex a thing to do. We aren’t saying it’s simple, but with us doing the bulk of the work for you, including managing the whole process, it is relatively straightforward.
There are 6 stages to becoming and staying certified to BS 10012:
- Establish a system that complies with the standard
- Carry out a Data Protection Impact Assessment [DPIA] to understand what data you handle
- Make everyone aware of the system and any changes in ways of working that have come about
- Operate the system to
a. Make sure it works efficiently
b. Build evidence of compliance with the requirements of the standard
c. Get staff familiar with it - Appoint a “certification body” to independently assess whether you comply with the standard. We recommend you choose a UKAS accredited body (see below)
- Keep using the system once it has been certified (to keep the certificate)
There is more detailed information below about the various stages you need to go through.
Your BS 10012 certification journey
Getting Started
- Provide a comprehensive briefing of what the standard and GDPR asks you to do in simple to understand terms
- Begin to understand in detail how you operate
- Set a timetable and stick to it
- Decide what you want covered by the certificate – which sites, products and services.
- Put the right resources in place
- Collect all existing documentation
- Establish a dedicated client portal on our collaboration and document sharing platform
- Begin identifying and recording all your information assets
- Begin creating an Information security asset register
- Begin understanding how well you comply or otherwise to GDPR
Implementing
- Establish a detailed project plan in our online project management platform (and stick to it)
- Undertake a technical audit of your system (with our cyber security/info sec partner)
- Carry out a Data Protection Impact Assessment (good practice and mandatory for GDPR)
- Decide with you what you need operationally
- Map out your business processes
- Complete a gap analysis between what the standard requires and what you have/do already
- Implement the system
- Complete required documentation
- Submit the system to Episode Head Office for final QC checks
- We return it to you for your final approval
- Brief staff
- Separate consultant Internally audits the system
- Carry out a management review
Certification
- Work with you to select and appoint a UKAS accredited certification body.
- Be onsite throughout the certification process
- Address any issues that arise during the audit
- Brief you on post-certification activity
a. 3 year cycle of annual surveillance audits and
b. what you need to do throughout the year to maintain the system - Agree where the finished, certified system should be housed
Episode guarantees certification
FAQ’s
What if I haven’t got IT or info sec expertise in the business?
Episode has plenty of experience, and some really helpful tools to deal with most requirements.
As part of any information security project undertaken by Episode, we get our info sec/cyber security expert partner to undertake a detailed audit of your system (using penetration tests, network sniffers, etc.) to identify any issues. If you feel you need their help rectifying issues, they will give you a fixed fee proposal for the work.
Will it create red tape and take too much time?
Done wrong, absolutely. Too many systems we see have a form or document to cover every aspect of the standard. That’s the easy way to build a system, and an equally easy way to cripple you operationally. You know when this is the case when you spend a month “updating” (i.e. creating false) records, etc. before the auditor next comes.
Done right, as we will make sure it is, the system should be at the core of how you work. Remember, we make ISO work for you, not the other way around.
How long will it take?
It is difficult to give precise timescales, as it depends on a number of things such as how complex the business is, how close you are to complying with the standard already, and so on. We recommend planning for it taking at least 4 to 6 months.
Why should I choose Episode?
For a fixed cost we will do as much of the work as possible, and guarantee certification.
Episode has worked with over 40 clients, many of whom have more than one standard they comply with (one has 5). All have been successfully certified and many subsequently ask us to help them maintain certification, and get more out of the system.
How much will it cost?
There are the following costs that will arise
- External consultants
Episode always gives a fixed fee proposal for a project, and we include guaranteed certification. A typical BS 10012 project is about £4,550, but this does depend on the size and complexity of your business.
- Certification costs
You will need an external company certify the system as being compliance with the standard. There many certification bodies that can independently assess (certify) your system against the standard. We will manage this process for you, and typical costs for a single standard range from £2,500 to £3,000 for a single standard, depending on size and complexity of the business.
- Internal business costs.
There may well be IT and other infrastructure work that needs doing, and we will give you a list of requirements as the first stage of any project.
To speak to an expert to discuss your requirements call us on 0113 801 9001 or email us at info@episodeltd.com
What is quality management and BS 10012?
Written specifically to help you comply with the General Data Protection Regulations [GDPR], BS 10012:2017, Data protection — Specification for a personal information management system is the British standard that sets out the requirements for a personal information management system and aligns with the principles of the European General Data Protection Regulation (EU GDPR). It outlines the core requirements organisations need to consider when collecting, storing, processing, retaining or disposing of personal records related to individuals. It then provides a framework for a Personal Information Management System, helping you to maintain and improve compliance with data protection legislation and provide assurance to your stakeholders. It provides a best practice framework for a personal information management system.
Whilst GDPR is new, it is a revision of laws that have existed for many years. Government agencies that supervise information security (the ICO in the UK) take a balanced, pragmatic approach. They realise no one can be perfect, and should the need arise for them to look into your organisation, the starting point is always “what have you done to protect against such issue?”. BS 10012 is an excellent way to demonstrate your intent. It is easily integrated with other popular ISO based management system standards.
When done correctly, gaining and maintaining ISO certification is not as complicated as most think. Trust Episode to make ISO work for you, not the other way around.
Contact us today on 0113 8019001 or click here to email us
It was only by utilising the expert guidance and experience of Episode that Thurston Group was able to attain certification within an exceptionally challenging time frame. We therefore offer our thanks to Episode Ltd. For the diligent and professional services provided. We also look forward to working with them again soon and would not hesitate to recommend their services."
Peter Spieight, Senior Divisional Director, Thurston Group, Wakefield
Roger's support was invaluable in terms of gap analysis, recommendations for improvement, and facilitation of the certification process. I would strongly recommend Roger to any organisation wishing to develop or improve its management systems, in a way which minimizes bureaucracy, and focuses on best serving the needs of the organization.
Gary Evans, Flour Corporation, Abu Dhabi
Roger and Sandy at Episode were great in helping us achieve not only one but two ISO standards 9001:2015 and 14001:2015. Episode were extremely helpful from the onset, they were able to break down the ISO standard so they were easily comprehensible and well applied to our business in a sustainable manner. They are a company that offers a guaranteed certification at the end of the process and they delivered it. I believe that the work completed during this process was key to us having won the Leeds Bid contract.
Harvey Mills, Managing Director, Forge Recycling, Leeds.
If Sandy hasn’t already updated you we are delighted to say we passed the transition audit for ISO 9001 and ISO 14001. Sandy did an absolutely fab job and all credit to her, we have loved having both of you here it’s been a pleasure.
I have had a brief chat with Morgan[the CEO] about the next steps and how we manage things going forwards. Morgan will be in touch with you soon about this and getting Episode/Sandy back in on a regular basis. Once again many thanks for everything and especially to Sandy!!
Morag Tearne, HR and Health & Safety Manager, H. Slingsby plc, Shipley
Episode is always prepared to go the extra mile. When in a tight spot the lead consultant carried out an audit for us at very short notice (on a Sunday afternoon) to keep us on track. What is important to us is the advice they give us is practical and tailored to us. The quality of output Episode produces is very high.
This has resulted in us having a multi-year managed service from Episode so as a company we know our ISO 9001, ISO 14001 and ISO 45001 integrated system is up to date and working for us.
Gareth Walters, Financial Controller, Sports Turf Research Institute, Bingley.
When asked by Episode what three things they do well, and what three things they could improve upon, my answers were:
Done well
1. Client Communication, responded to queries very quickly
2. Requirements of the standard were communicated in a simple manner.
3. Assistance from initial implementation to date of assessment was very good.
I can honestly there is nothing I feel they should improve upon.
Paul Hunneybell, Operations Manager, Fenland Fire Contracts Limited, Luton
The consultant worked with the team in Scott Bader Middle East Ltd. to completely re-engineer our Integrated Management System incorporating ISO 9001, ISO 14001 and OHSAS 18001. Until then we were slaves to the ISO audits, with the systems not adding much value beyond certification. Now we have a business management system that really works for us and is truly integrated into our operations. We were also successfully re-certified along the way.
John Kemp, CEO Scott Bader Middle East, Africa and Asia
The consultant really focused on making our systems and processes work better for us, not just help us comply with ISO 9001. He was able to work with Department Heads and Senior Management to shape their strategic thinking about quality and business objectives without telling them what they had to do because the standard says so.
Karim D'Alessandro, HSE Director, Shelf Drilling Inc.