It's now or never to prepare for GDPR – What to do now? | Featured Articles | ISOAH-CORPORATE

03 May, 2018

It's now or never to prepare for GDPR – What to do now?

Article: GDPR

GDPR is coming into effect from 25th May 2018 onwards. If you haven't complied with GDPR yet, it is probably too late.

EU's most demanding and far-reaching data privacy regulation till date, GDPR raises the bar on stringency of how data is collected, used and distributed. GDPR actually meant to give more power and control to the consumer on their data. But the shocking revelation from a study is, 51% of U.S. firms with European customers either don't think these new customer privacy rulings apply to them or haven't yet implemented plans to deal with GDPR.

The truth is, GDPR is a global issue and ignorance of it could lead to some very serious financial repercussions. If you are a US or North American company doing business with EU countries — that is, processing the data of any EU citizen — then heads up. Fines for non-compliance can be as much as $21 million, or 4% of your organization's annual worldwide turnover, whichever is greater.

But this must be admitted that GDPR standardization serves as a potential boon to organizations operating across multiple EU member countries, reducing the complexity of compliance by ensuring that a single set of legal processes and rules will apply regardless of the location. At the same time, GDPR requires thoughtful action on the part of any organization doing business with citizens of EU member countries, in order to adapt data handling practices to comply with the new legally enforced standards.

Just few weeks away, companies should consider GDPR seriously to establish a solid foundation for achieving compliance. All existing data stores and all new processes and responsibilities under GDPR must be thoroughly understood in order to then correctly apply solutions and effectively execute data security measures.

How to prepare for GDPR?

For complete compliance with GDPR will take time. At this moment, some preventive measures can prevent the potential fines. Follow the steps:

1. Understand the regulation:

An organization must begin the process with the thorough understanding of the compliance. The GDPR legislation is complex and far reaching laying out some specific mandates for business. It is essential to plan your approach to GDPR compliance now with the key players in your organization who are well aware of the new changes and thoroughly understand the compliance. Implementing GDPR could have significance resource implications especially for larger and more complex organization. Do not leave it to last moments but start your preparation today.

2. Assess existing process:

Performing a data audit will help to assess what personal data you hold, where it came from and who you share it with. GDPR makes it clear that businesses must have the consent of the consumers to collect, process, use and share personal data. Ensure you verify how consumer consent was given to you and clearly state your intentions on how the data will be used. Once you have the clear picture of all the data, perform a gap analysis. Doing so will further delineate where new processes and personnel are needed in order to improve existing practices and achieve GDPR compliance.

3. Get smart guidance and appoint data protection officer:

Seek guidance from experts in the field. The privacy information should be communicated well. Reviewing current privacy policy, putting a plan in place for necessary changes in time for GDPR implementation, checking the procedures to ensure they cover all the rights individuals have with their data, implementing GDPR compliance need proper guidance. GDPR requires you to maintain records of your processing activities. Under GDPR, multinational companies working across EU must appoint Data Protection Officer or an external data protection advisor who will take proper responsibility for your data protection compliance and has the knowledge, support and authority to carry out their role effectively.

4. Identify new technology to fill gaps:

Allocate adequate budget, tools and resources to address the compliance. It must be determined what type of technology is required to fill any gaps against outstanding data security, data auditing and data privacy needs. Organizations need to implement new technology solution to meet GDPR's data discovery and incident detection and response requirements. Elaborate business processes have more complex data risks. To meet this challenge, an organization must identify and address vulnerabilities. Fully automate processes for sensitive data governance. The purpose here is to protect data at the element level as it enters the corporate network. When the auditing process is automated, the company will be able to understand what sensitive data is connected to, what the data is mingling with, and who is accessing it. The reason for most of the data risks is human error. Most companies are training their staff to help them understand what compliance means so that human error does not be the reason for a security breach. And for this, a careful gap analysis and process mapping are so crucial.

5. Continuous monitoring:

Even after the compliance, an organization must be very cautious and certain that the best practices aren't abandoned with time and sensitive data never passes through systems that are not secured. Continuously generating sensitive data reports is necessary for data at rest and in motion. The data governance solution should have monitoring capabilities so that you can get the real time report if any user, device or system accesses sensitive data as well as track how and where sensitive data is moving.

Investing a hefty amount on GDPR might seem to be very expensive right now but it is definitely not more than the cost of fines later. At a time when data security measures must cope with attacks that are increasing in their volume and sophistication, GDPR requires organizations to execute a comprehensive strategy to protect data privacy.