GDPR Compliance & Personal Data Protection

The General Data Protection Regulation is set to be a fact of life in less than six months, and arguably the biggest challenge facing enterprises across the globe is locating personal data sources and classifying them correctly.

Most organisations will have some degree of legacy data, whether paper or digital, and before taking any technical steps at all it is essential to ensure that this personal data locked in ERP and CRM systems is classified according to risk.

Although the general thrust of GDPR has been widely debated in the media and among security industry peers, much of the coverage to date has focused on the huge penalties for non-compliance, rather than looking at the opportunities of data discovery and process improvements for enterprises of all shapes and sizes. Indeed, a recent study found that 60 percent of EU organisations say they will face serious challenges in being GDPR-compliant, and in fact 40 percent of respondents report that their organisations do not view compliance with GDPR by the deadline as a priority.

Geographical Complications
This is all a matter of fact, rather than conjecture, but business responses to GDPR and its implications have varied considerably in my experience. Anecdotally, not many European and UK organisations have been giving the regulation enforcement date as a high priority as perhaps they could have done. Some will only be kicking off in December 2017, leaving them a mere six months to comply.

US companies are generally speaking not particularly prepared, and the complexity of the legal landscape is going to make it difficult for those who have not thought ahead. 

For example, companies with significant operations such as head offices outside the EU face the issue of adequacy, so will potentially need to construct a lawful mechanism to transfer data. The model contract clause is one such mechanism, another is binding corporate rules, but this mechanism does require prior planning, and approval from the ICO.

Geography and legalities aside, the most important element of a robust GDPR strategy is to evaluate people and processes first, technology is a facilitator to the processes that need to be put in place. 

This initiative is not a tick box compliance approach, and there is no plugin or tool that will simply make it all go away. On the positive side, there is plenty of opportunity to take this watershed moment in personal data management and look at harmonising company data policies, which have often grown up over time with significant overlap.

Data Discovery
Finding the precise location of data defined as ‘personal’ under GDPR from among the thousands of tables and columns (or fields) in complex and customised packaged systems, represents a significant challenge. 
Traditional tools and methods, such as searching for documentation, using templates and reference models or employing external consultants, do not address the challenge in an effective and timely fashion.

Safyr offers an interesting approach, it interfaces with all the most popular ERP and CRM solutions in order to speed up that discovery process. 

Speed and accuracy here are vital for several reasons, obviously ‘bad’ data discovery initially means that risk assessments will be skewed, and even worse it may cause a loss of focus, so that less critical issues are fixed first, rather than the real high risk issues. These issues are the major benefit of using a discovery tool, rather than attempting hand cranked scripted procedures.

Data Protection Impact Assessment
Unstructured data will be a major challenge for many organizations because of the nebulous nature of it and obtaining full information about it. For example, Salesforce, which historically slurps up huge amounts of information that might not be essential for everyday business, but will be highly relevant in a GDPR context.

The result is hidden risk, where in the event of a data breach business could be exposed to far greater penalties than they think if information is not correctly categorised. 

All new systems or updates to data systems should have a complete data protection impact assessment (DPIA), as mandated under article 35, that assess the risk profile, as well as facilitating the scoping of a new system. A DPIA is an excellent programme management technique, and should from now be a matter of course - if it was not before!

Information Asset Register
Another vital element of preparation for and compliance with GDPR is the setting up of an Information Asset register, which is specifically detailed under article 30. The aim is to inventory all the systems, electronic and paper based, that hold personal information. 

Data glossaries and/or data dictionaries support this register, and there are plenty of tools that can help with this, including many content management systems.

Overall, the imminent arrival of GDPR should be seen as a fantastic opportunity to get in-house policies, systems and technologies into shape, as well as demonstrating compliance in time for the deadline. While many enterprises are only just beginning to get started, those with the longest run-up will be those with the fewest unforeseen problems come mid-2018.

Information-Management

For Further GDPR Information please also contact The GDPR Advisory Board

You Might Aslo Read: 

The GDPR Advisory Board Offers Expert Advice:

 

« US Cyber Soldiers Go To The Battlefield
Canada’s Electronic Spies Unleashed »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

RPC

RPC

RPC is a business law firm. Practice areas include technology and cyber risk.

ObjectSecurity

ObjectSecurity

ObjectSecurity is a leader in authorization policy automation. With OpenPMF, you can manage application security policies for access control and auditing.

Cyber Seguridad (Cyberseg)

Cyber Seguridad (Cyberseg)

Cyberseg provides specialized Cybersecurity services, including managed services (SOC / CERTs) and solutions for the protection of critical infrastructures.

Virsec Systems

Virsec Systems

Virsec detects and remediates previously “indefensible” advanced memory-based attacks on critical applications and server endpoints.

Swiss Cyber Storm

Swiss Cyber Storm

Swiss Cyber Storm is a non profit organization hosting the international Swiss Cyber Storm Conference and running the Swiss part of the European Cyber Security Challenges.

CyberSure

CyberSure

CyberSure is a programme of collaborations and exchanges between researchers aimed at developing a framework for creating and managing cyber insurance policy for cyber systems.

Cyber Threat Alliance

Cyber Threat Alliance

CTA is working to improve cybersecurity of our digital ecosystem by enabling near real-time cyber threat information sharing among companies and organizations in the cybersecurity field.

Bace Cybersecurity Institute (BCI)

Bace Cybersecurity Institute (BCI)

Bace Cybersecurity Institute focuses on understanding, empowering and taking action across four critical areas driving continual improvement toward a safer, more secure cyber world.

Finnish Security & Intelligence Service (SUPO)

Finnish Security & Intelligence Service (SUPO)

The Finnish Security and Intelligence Service is a government agency tasked with combating serious threats to national security in Finland.

Cyber Management Alliance

Cyber Management Alliance

Cyber Management Alliance is closing the divide in cyberspace by bringing together the best qualities of thought leadership and operational mastery of cyber security management.

Hackurity.io

Hackurity.io

Hackurity.io is a high energy IT security start-up founded in 2021 out of the frustration that IT Security is highly fragmented and reactive.

Sendmarc

Sendmarc

Sendmarc automates the process of protecting your domain from being used in email impersonation and phishing attacks.

Avanade

Avanade

Avanade is a leading provider of innovative digital, cloud and advisory services, industry solutions and design-led experiences across the Microsoft ecosystem.

ITRM

ITRM

ITRM are one of the UK’s top managed service providers and offer a range of award-winning IT solutions, from ad-hoc consultancy to cyber security.

Academia the Technology Group

Academia the Technology Group

Academia specialise in the supply of software, IT hardware, training and service solutions to the public sectors, business and pro media markets.

Triam Security

Triam Security

Triam Security are on a mission to make software supply chain security effortless, effective, and invisible - so developers can move fast without leaving security behind.