Tuesday, January 26, 2021
Corporate Compliance Insights
  • Home
  • About
    • About CCI
    • Writing for CCI
    • NEW: CCI Press – Book Publishing
    • Advertise With Us
  • Articles
    • See All Articles
    • NEW: COVID-Related
    • Compliance
    • Ethics
    • Risk
    • FCPA
    • Governance
    • Fraud
    • Internal Audit
    • HR Compliance
    • Cybersecurity
    • Data Privacy
    • Financial Services
    • Leadership and Career
  • Vendor News
  • Jobs
  • Events
    • Webinars & Events
    • Submit an Event
  • Downloads
    • eBooks
    • Whitepapers
  • Podcasts
  • Videos
  • Subscribe
No Result
View All Result
  • Home
  • About
    • About CCI
    • Writing for CCI
    • NEW: CCI Press – Book Publishing
    • Advertise With Us
  • Articles
    • See All Articles
    • NEW: COVID-Related
    • Compliance
    • Ethics
    • Risk
    • FCPA
    • Governance
    • Fraud
    • Internal Audit
    • HR Compliance
    • Cybersecurity
    • Data Privacy
    • Financial Services
    • Leadership and Career
  • Vendor News
  • Jobs
  • Events
    • Webinars & Events
    • Submit an Event
  • Downloads
    • eBooks
    • Whitepapers
  • Podcasts
  • Videos
  • Subscribe
No Result
View All Result
Corporate Compliance Insights
Home Data Privacy

The Procrastinator’s Guide to the GDPR

by Maxine Henry
April 3, 2018
in Data Privacy, Featured
“urgent” sticky note on the date of May 25

12 Steps to Compliance

We all procrastinate. But when it comes to missing the May 25th deadline for complying with the GDPR, this is one compliance project that you need begin right away. Learn how the GDPR may impact your business and what you need to do to become compliant.

Why put off until tomorrow what you can do today? When it comes to the European Union’s General Data Protection Regulation (GDPR), many — even most — enterprises may be doing just that.

In one survey, most United States company representatives said they expect to be fined for noncompliance with the GDPR.

If so, let us hope they have budgeted accordingly. When the law takes effect on May 25, 2018, failure to comply can incur a fine of €20 million ($25 million, as of this writing) or 4 percent of annual revenues, whichever is greater.

Many enterprises simply are not ready for this game-changing privacy-and-security law — in spite of its having been adopted nearly two years ago, in April 2016.

Recently, PwC found that nearly one-quarter of U.S. multinational companies hadn’t even begun preparing for the GDPR, and only 7 percent had reached full compliance.

Procrastinators, take heart: It isn’t too late. May 25 is just around the corner, but even those organizations just starting now can still make the deadline.

What is the GDPR?

The first step toward following any rule is, of course, understanding it. Do you know precisely what the GDPR is and how it applies to your enterprise?

Put simply, the GDPR is the first-ever global privacy and security law. GDPR outlines new rules — 99 of them — for protecting EU citizen data. These provisions, among other things:

  • Broaden the scope of the term “personal data”
  • Grant EU citizens absolute rights over their personal data, including the “right to be forgotten”
  • Set stringent requirements for how entities process, store and share citizen data
  • Establish rules for securing EU citizen data, including privacy protections
  • Set timelines and guidelines for responding to and reporting data breaches
  • Restrict the collection and processing of specific types of data, including that of minors
  • Require accountability for security breaches and data theft
  • Require that privacy protections be designed into business operations
  • Impose strict penalties for noncompliance

No matter where your business is located — inside the EU or elsewhere — it must comply with the GDPR if it collects, processes, shares or stores personal data such as names, physical addresses, phone numbers and email addresses of any EU resident citizens.

There is one exception to this rule. “Anonymized” data — that which is permanently encrypted or made anonymous so that its owner cannot be identified — is not governed by the GDPR.

A 12-Step Program

With so many provisions, it isn’t surprising to learn that some are putting off the inevitable task of compliance.

Those feeling overwhelmed can take heart, perhaps, from U.K. Information Commissioner Elizabeth Denham, who says there is no need to fear the new regulations.

“The GDPR is a step change for data protection,” especially for enterprises already in compliance with existing data protection laws, she told WIRED magazine.

Even conforming to a step change can require a series of steps, and the U.K. Information Commissioner’s Office has put together 12 of them for organizations to follow on the road to compliance. Recommendations include:

  1. Increase awareness of the GDPR — what it is, and what it will require — throughout your organization.
  2. Document the EU citizen personal data you now have, including where it is located and whom you share it with, perhaps by conducting an information audit.
  3. Review and revise your privacy notices. The GDPR says these must be concise and clear: no more long, confusing goobledygook.
  4. Know EU citizens’ rights. The GDPR gives EU citizens absolute rights over their personal data including:
    • to know how you will use it and to consent to those uses, as well as to be informed of changes;
    • to change their mind about what they will and won’t allow, to have their data returned to them if they ask (“data portability”); and
    • to demand that you and everyone you have shared their data with delete it from all databases (the “right to erasure” or “right to be forgotten”).

Do you and your teams know these rights, and where your gaps are?

  1. Know your abilities. If an EU citizen wants access to their data, you must provide it within one month of their request. Could you do this now? If not, how would you handle these requests?
  2. Cover your bases. The GDPR does not allow data processing, storing or sharing recklessly, but says you must provide legal bases for doing so. Do you know what yours are?
  3. Check for consent. EU citizens must give consent and do so clearly and unambiguously for you to collect, process, store or share their data. Do your policies fill the bill? To help you assess, the ICO has compiled this consent checklist.
  4. Remember the children. Under the GDPR, the rules will change for handling children’s information. You may need to get permission from their parents or revise your privacy policies so younger minds can understand them.
  5. Prepare for the worst. The GDPR puts very specific policies in place for handling data breaches – among them requiring you to notify local authorities and, in certain cases, affected EU citizens within 72 hours of the breach. How will you comply?
  6. Bake it in. Privacy can no longer be an afterthought after May 25; it must be designed into your systems from the very beginning. “Data protection by design and default” is a key GDPR requirement, as are, in certain high-risk instances, data protection impact assessments (DPIA). Who will conduct your enterprise’s DPIA, and how?
  7. Designate an officer. Certain organizations, especially larger ones, will need to establish a Data Protection Officer to oversee compliance with the GDPR. Do you need one? Who will it be — someone already on staff, such as your Chief Security Officer, or someone new?
  8. Think globally. If your organization has more than one EU office, you will need to establish one as the lead data protection supervisory authority — the primary location where decisions about data processing and GDPR implementation take place. Which location will you choose?

Ninety-nine provisions can seem a daunting number to fulfill, especially in the relatively short time remaining between now and May 25. As noted, however, companies now doing business in the EU likely already meet many of the GDPR’s provisions.

If you’re not in compliance with the GDPR, there’s no better time to start the process than now. As with any journey, the best way to reach your destination is one step at a time. What’s stopping you from getting there?


Tags: GDPR
Previous Post

10 Lessons from Operation Car Wash

Next Post

Retaliation? Tell It to the SEC

Maxine Henry

Maxine Henry is a GRC expert at Reciprocity. She is actively engaged with helping customers take a holistic approach to governance, risks and compliance. Maxine has consulted at major firms including The Walt Disney Company, Cylance, Experian and Hyundai Autoever America. Her accomplishments and skills include governance, risk and compliance cybersecurity; data privacy and protection; e-discovery and General Data Protection Regulation (GDPR). She has helped clients strategically and tactically with developing technical and compliance solutions.

Related Posts

digital cybersecurity and network protection

Vetting Vendors’ Cybersecurity

January 26, 2021
illustration of man on ladder with binoculars, 2021 outlook concept

Financial Services Compliance in 2021

January 25, 2021
illustration of mafia man in silhouette with red tie

The Mafia’s Jackpot: How Criminal Organizations are Profiting from COVID-19

January 22, 2021
illustration of videoconference, screen and speech bubbles

New Risks as COVID-19 Forces Rapid Technology Adoption

January 21, 2021
Next Post
silver whistle on green background

Retaliation? Tell It to the SEC

Access realtime data
Dynamic Risk Assessments with Workiva

Special Coverage

Special COVID page graphic

Jump to a Topic:

anti-corruption anti-money laundering/AML Artificial Intelligence/A.I. automation banks board of directors board risk oversight bribery CCPA/California Consumer Privacy Act Cloud Compliance communications management Coronavirus/COVID-19 corporate culture crisis management cyber crime cyber risk data analytics data breach data governance decision-making diversity DOJ due diligence fcpa enforcement actions financial crime GDPR GRC HIPAA information security internal audit KYC/know your customer machine learning monitoring regtech reputation risk risk assessment Sanctions SEC social media risk supply chain technology third party risk management tone at the top training whistleblowing
No Result
View All Result

Privacy Policy

Follow Us

  • Facebook
  • Twitter
  • LinkedIn
  • RSS Feed

Category

  • CCI Press
  • Compliance
  • Compliance Podcasts
  • Cybersecurity
  • Data Privacy
  • eBooks
  • Ethics
  • FCPA
  • Featured
  • Financial Services
  • Fraud
  • Governance
  • GRC Vendor News
  • HR Compliance
  • Internal Audit
  • Leadership and Career
  • Opinion
  • Resource Library
  • Risk
  • Uncategorized
  • Videos
  • Webinars
  • Whitepapers

© 2019 Corporate Compliance Insights

No Result
View All Result
  • Home
  • About
  • Articles
  • Vendor News
  • Podcasts
  • Videos
  • Whitepapers
  • eBooks
  • Events
  • Jobs
  • Subscribe

© 2019 Corporate Compliance Insights