Guidance for Compliance with GDPR

Business Data SecurityThe General Data Protection Regulation came into force in May 2018. The following steps provide guidance on how to be compliant with the GDPR:

  • Assess current Data systems, policies and procedures
    • Be aware of what kind of data is held, where it is stored and how it is protected. What kind of software and technology is in place to protect data?
    • Review the current data-related policies and procedures, including encryption, remote access, mobile devices, sensitive information, HR exit procedures, third parties and data breach notifications.
    • Consider requesting a third-party data security company to carry out an objective assessment.
  • Identify risks and gaps to meet the GDPR requirements
    • Are the current systems, policies and procedures adequate to protect data? Are there any risks of data breaches?
    • Individuals’ rights – are there systems in place to transfer personal data to other companies and to delete personal data if requested?
    • Are requests for permission to use customers’ personal data clear on the purpose and period of time?
  • Identify solutions
    • Research suitable solutions for any identified risks or gaps.
    • Solutions must be implemented as soon as possible given the GDPR is already in force.
  • Designate a Data Protection Officer or lead contact
    • A DPO can be appointed if mandatory for the business, or an internal lead contact person can be appointed for data protection initiatives and to communicate with the Data Protection Authority if required.
    • The DPO or lead contact should communicate with senior management to discuss data protection strategies and for approval.
  • Staff training and awareness
    • Ensure that staff are aware of the importance of data protection and any new/amended processes to comply with the GDPR.
    • Ensure internal teams communicate with each other to maintain data protection, such as IT, Security, Legal and Compliance teams.