GDPR & the Legend Solution
F REQUENTLY A SKED Q UESTIONS
The European Union
General Data Protection
Regulation (GDPR) will take
effect in the UK on 25th of
May 2018, placing
increased data security and
privacy responsibilities on
all organisations handling
data. Legend delivers
answers to questions that
are frequently asked on this
topic.
How will Legend ensure that
personal data is processed in
accordance with GDPR?
Legend is registered with the
Information Commissioner’s Office
(registration Z9255164, since
2005). Legend acts as a data
processor for its customers through
the provision of its management
system in a Software-as-a-Service
model. Personal data in the Legend
system is protected by being held
exclusively at secure Tier III certified
datacentres that are ISO27001
certified and PCI DSS compliant,
with system access controlled by
strict security measures limiting
access to authorised users only.
Legend also holds ISO27001
certification and operates within a
tightly managed Information
Security Management System
(ISMS), which is audited externally
by British Standards Institute. All
Legend staff are trained regularly
on information security and are
independently vetted with
background checks where data
access is required as part of their
job function.
How will Legend help enforce the
customer’s “right to be forgotten”
and ensure that out of date data is
deleted or destroyed?
The Legend solution has a data
redaction facility which enables
personal data to be redacted whilst
retaining the non-personal
management information and
statistics. Redaction can be
triggered by individual request or
linked to a business rule which can
be set in the system, such as nn-
months after a member leaves.
This allows each customer to have
its own data retention policy in their
Legend system. Once redacted an
individual's personal information
record is no longer available in
general use.
In special cases, such as in a
dispute, claim or for legal reasons,
requiring access to an individual's
record after redaction, it is possible
to identify and access that record
but only via a secure route outside
of the operational Legend system
and only with the associated
permission activated.
Should there be a need to delete
the data, for example at contract
end, this is undertaken by Legend
in accordance with industrial data
disposal standards. Additionally, on
hardware disposal, all
decommissioned media is securely
wiped and destroyed as part of the
hardware disposal process in line
with our ISO27001 processes.
Similarly, the destruction of failed
hard drives is a controlled process.
We use a combination of specialist
firms for drive destruction,
depending on supplier, and the
service provided by HP for all HP
drives.
How will Legend maintain security
of customers’ data with reference
to physical security of locations?
The Legend system is hosted
exclusively at two secure Tier III
data centres: a primary and a
secondary datacentre. The
datacentres have the following
physical security controls in place:
perimeter security; manned
physical access controls with
access by appointment only; anti-
ram barriers, restricted access to
information processing and storage
areas.
In addition to this, our offices are
access controlled and have
physical security risk assessments
which analyse and identify controls
for the following: fire and flood
protection requirements; building
services, equipment and utilities
resilience; business continuity
requirements; business insurance
and indemnity requirements.
Legend also operates a clear desk
and screen policy which applies to
all staff. No customer data is held
at our offices.
How will Legend maintain security
of customers’ data with reference
to security of individual databases?
Access to individual data tables
containing sensitive information are
protected by system security
settings. System data is stored and
transmitted securely using
appropriate encryption protocols.
Further, the Legend system utilises
separate, discrete databases per
customer.
How will Legend ensure the
reliability of its employees who have
access to personal data?
All Legend staff that are supporting
or accessing the system are
background checked and regularly
audited for access control as part
of our ISO27001 ISMS. Legend
certifies that all individuals who are
involved in your contract and the
software development process
pass the appropriate background
investigation.

Are annual independent reviews of
Data Protection and Security
Assessments, including penetration
and vulnerability assessments,
carried out to identify privacy and
security risks for the required
service?
Yes. ISO27001 is a rigorous
standard to maintain, which
demonstrates how seriously we take
customers’ data and information
security. This means that we
undergo regular external and
internal audit, third-party scanning
and penetration tests to maintain
our ISMS.
How will you ensure the systems
and procedures comply with the
principle of "Data Protection by
Design", so it promotes security and
data compliance throughout the
whole process?
The solution has been designed
from the bottom up to protect data
and privacy, also, prior to GDPR, in
accordance with Data Protection
legislation. The Legend solution is
designed and configured to meet
high levels of security and access
control, and data protection,
ensuring that only minimal changes
have been needed to enhance the
system to fall within the new
guidelines.
All staff are trained and regularly
educated on ISO27001 matters
including, processes, threats and
counter measures. The
development process includes
regular forums conducted in an
environment of continuous
improvement.
We supplement this with periodic
externally conducted penetration
tests and monthly network scans to
draw attention to issues or
vulnerabilities so that these can be
proactively remedied. Day-to-day,
development coding is subject to
peer code-review, and architecture
analysis. All developments are then
further tested though independent
Quality Assurance and User
Acceptance Testing prior to
release. Post-release monitoring is
performed on the system to identify
any issues that could affect
security.
As per our ISO27001 ISMS
procedures, Legend ensures that
all infrastructure is kept up to date
with the latest operating system,
hardware, and firmware patches,
ensuring all devices receive the
latest security patches.
Legend has active maintenance
contracts with all hardware and
software suppliers. This means that
all patches are tested and checked
for reliability and security by the
manufacturer prior to deployment.
They are then tested by Legend
against a non-live environment
before being released to the live
environment.
Critical patches that may affect
system uptime or carry serious
security risks are applied within one
week of notification of the patch. All
patches are released during our
maintenance window and do not
affect the performance of live
operations. In the unusual event
where a patch is so critical it needs
to be applied outside of the
maintenance window, the customer
will be notified and we will liaise with
them to agree a release time in
order to minimise risk and impact.
Legend also has in place a Security
Incident and Event Monitoring
system and Two Factor
Authentication security for access
to key infrastructure services.
How can users serve a request by a
data subject (e.g. member) asking
what information is held on them?
The Legend system has standard
reports to produce a list of the
relevant personal information held
in the system.
Is customer data stored in the UK?
Yes, it is stored in the UK only.
Legend can also confirm that no
data is transferred outside of the
European Economic Area in its
data processing activities. This
Page 2 of 2
statement applies to backups and
archives too.
Can it be accessed by Legend staff
outside of UK (e.g. Canada)?
Access is normally limited to UK
staff. In certain circumstances, out
of hours support could be provided
from our Canadian office; at all
times subject to the same internal
processes and controls as in the
UK. Further, the Legend support
representative is only able to view a
session or login if the user first
consents. If there were a desire not
to permit support from Canada this
could be catered for but may limit
some out of hours support
availability.
How will the system meet the
consent mechanisms within the
GDPR?
Legend provides the ability to
record consent at many levels,
including customer specific
consent. Consent choices can be
easily updated by staff or members.
Customers need to be mindful that
the way they obtain consent should
be inline with the GDPR guidelines.
Will the solution be updated at
Legend’s cost to comply with the
GDPR?
Yes, Legend is committed to
maintaining and updating
customers’ legislative requirements
and warrants that this service will be
ongoing.
Will the solution be updated prior to
the effective date of the GDPR?
Yes, through Legend’s seamless
free upgrades process.
F URTHER
I NFORMATION
ICO guidance on preparing for
GDPR
Health Club Management
Article