ARE YOU READY? A Practical Guide to GDPR Compliance

?

WHAT IS THE GDPR? The European Commission will introduce the General Data Protection Regulation (GDPR) - a new set of strict privacy regulations designed to protect the personal data of individuals located in the EU

MAY

2018 3

!

On May 25, 2018, all businesses that handle EU personal data must be GDPR compliant, regardless of geographic location.

US

Are Businesses Prepared? (June 2017)

UK

Rest of the EU

40%

25% 20% 15% 10% 5% FULLY PREPARED

READY TO START PREPARATION

NO PLANS TO PREPARE

Less than 5% of companies are prepared for the significant changes that the regulation will bring.

Source: https://community.spiceworks.com/research/gdpr-impact-on-it 4

Many companies outside the EU assume the GDPR will not apply to them... ...but it applies to every organisation offering goods and services to EU citizens

COMPANIES THAT BELIEVE GDPR WILL NOT APPLY TO THEM Source: https://community.spiceworks.com/research/gdpr-impact-on-it 5

3%

9%

43%

10%

Uncertainties about the GDPR have been causing companies to delay their efforts to comply. FOR EXAMPLE... • Most don’t understand the steps needed to comply with GDPR • IT teams are concerned about the scope and complexity of GDPR compliance • Some incorrectly believe the

GDPR Requirements Not Clear Management Doesn’t Understand Impact Will increase IT complexity GDPR will require a lot of user training GDPR will make my job difficult GDPR will make doing business difficult Cost of complying

None

deadline will be extended Don’t Know

6

20%

30%

40%

WHAT HAPPENS IF YOU’RE NOT READY? It’s the company’s responsibility to be prepared, and the cost of non-compliance can go way beyond the fine. Damage inflicted on a brand following a breach can permanently affect the bottom line of an organisation.

€20 million or 4% of worldwide revenue

Damage to reputation

7

?

Loss of customers

TAKE ACTION!

8 STEPS TO PREPARE FOR GDPR Complete content governance is the foundation for GDPR compliance. If you can find, account for, and understand your data... you can report on it.

8

Step 1

KNOW YOUR DATA

Determine what type of personally identifiable data you have on file, how sensitive it is, and where it is held.

9

Manage access controls

Step 2

KNOW WHAT YOU NEED TO DO Construct a detailed roadmap on how to address any gaps in your organisation while handling sensitive data. Review and update your existing privacy notices and communications policies.  

10

Control data residency

Step 3

BE TRANSPARENT Look into hiring a Data Protection Officer (DPO) to implement and manage your data handling processes and procedures. Their role is to make sure that only the minimum amount of customer data is collected and processed.

The DPO must also provide the Data Protection Authority and the general public with access and insight into how customer data is managed.

11

Set up a system monitoring compliance activity in high risk areas.

GET PROPER CONSENT

Step 4

MONITOR YOUR DAILY ACTIVITIES It’s important to have full visibility into the way your company handles data. One of the easiest ways to maintain visibility is to keep an open line of communication with everyone involved, reviewing and updating privacy policies on a regular basis.

PROCESS SENSITIVE DATA

SHORTEN ACCESS REQUEST TIMEFRAMES

ENSURE COMPATIBILITY OF NEW SYST