Guidance for Compliance with GDPR

Business Data SecurityThe General Data Protection Regulation comes into force in 2018. Companies must ensure they meet the GDPR requirements before then. The following steps provide guidance on how to prepare for the GDPR:

  • Assess current Data systems, policies and procedures
    • Be aware of what kind of data is held, where it is stored and how it is protected. What kind of software and technology is in place to protect data?
    • Review the current data-related policies and procedures, including encryption, remote access, mobile devices, sensitive information, HR exit procedures, third parties and data breach notifications.
    • Consider requesting a third-party data security company to carry out an objective assessment.
  • Identify risks and gaps to meet the GDPR requirements
    • Are the current systems, policies and procedures adequate to protect data? Are there any risks of data breaches?
    • Individuals’ rights – are there systems in place to transfer personal data to other companies and to delete personal data if requested?
    • Are requests for permission to use customers’ personal data clear on the purpose and period of time?
  • Identify solutions and create a timeline to implement them
    • Research suitable solutions for any identified risks or gaps.
    • Solutions must be implemented before the GDPR comes into force.
  • Designate a Data Protection Officer or lead contact
    • A DPO can be appointed if mandatory for the business, or an internal lead contact person can be appointed for data protection initiatives and to communicate with the Data Protection Authority if required.
    • The DPO or lead contact should communicate with senior management to discuss data protection strategies and for approval.
  • Staff training and awareness
    • Ensure that staff are aware of the importance of data protection and any new/amended processes to comply with the GDPR.
    • Ensure internal teams communicate with each other to maintain data protection, such as IT, Security, Legal and Compliance teams.