The Most Important Part of GDPR Compliance

Click here to get this post in PDF

May 25th marked the deadline for GDPR compliance. The fundamental question is whether your organization complied with the requirements in time. Well, if you are yet to comply, then you shouldn’t worry since you are not alone! The regulation has 99 directives which have been a hindrance to compliance with many CIOs report intimating that should the privacy, and security laws take effect, they would face difficulties meeting their mandates. As such, most enterprises are worried about heavy penalties and loss of clients’ trust that may occur due to non-compliance.

You should realize that your ability to do business with various entities and companies in the EU will be hurt by GDPR non-compliance. Also, you will be required to pay hefty non-compliance fines that may constitute approximately 4% of annual global revenue or an estimated 20 million euros; whichever is larger. To avoid this, your organization should start to pursue the GDPR compliance code which portrays good faith to comply. This will help you avoid penalties as well as protect your organization’s name for future success.

First Step: Laying the Foundation

Your comprehension of GDPR regulations and its differences with the Data Protection Directive 95/46/EC is crucial for your organization’s compliance with the regulations. The primary intention of GDPR regulations is securing the privacy and codifying the ancient EU expectations of personal data protection. It achieves this by ensuring the following rights of individuals:

• Consent. Citizens must agree with any use of their information
• Special Categories. Data of specific groups be handled in a specific way
• Honoring Owner’s Request. If the owner of data request for deletion or return of data, the organization should honor the request

Every organization that transacts with the 28 states that are members of the EU must be GDPR compliance. Also, all websites that directly reach these citizens must abide by these regulations for guaranteed data protection.

Policy Matters

Your ability to comply with GDPR regulations requires that you upgrade your policies and procedures. You will need to start from the scratch where you’ll draft, edit, approve, update, implement, train, maintain and audit the policies. If you have clear policies that define the values of your organization, you’ll have an easier time complying with the regulations.

During the auditing process, the GDPR team will need written policies and proof of systems that are able to safely handle, track, store, and share personal data collected from clients. Never overlook policy management since it may lead to failure of GDPR compliance exercise.  Make sure that you follow the following steps for a successful policy development and management:

1. Build a system to manage your policies
2. Adopt a risk-based approach
3. Try hard to automate the process
4. Ensure a uniform and consistent format for your policies and procedures
5. Ensure proper record keeping for auditing and reporting
6. Limit changes to policies to only specific staff
7. Connect all your documents to GDPR principles

Finally, ensure that you keep policies inventory that gives sufficient details about every policy and procedure in your organization. In the inventory, including the details of how each policy fulfills the GDPR regulations to make it easy for the auditing process. Also, all your policies should be updated to conform to the latest GDPR regulations and ensure that your employees possess the latest document.

One Step at a Time

After instituting a policy management system and designing an updated policy inventory, you’ll need to take the next steps of GDPR compliance that you can easily handle if you have the right technology. The next compliance steps include:

• Risk assessment. Help to link your policies, procedures to risks that may come across your business
• Establish a budget
• Map GDPR controls to match the set standards
• Policy management automation
• Track attestations and keep proper records
• Link policy management tools to a third party and auditor needs
• Ensure an auditable processes and programs

To ease your compliance, you can use an app that will guide your path to GDPR compliance.

About the Author

Ken Lynch is an enterprise software startup veteran, who has always been fascinated about what drives workers to work and how to make work more engaging. Ken founded Reciprocity to pursue just that. He has propelled Reciprocity’s success with this mission-based goal of engaging employees with the governance, risk, and compliance goals of their company in order to create more socially minded corporate citizens. Ken earned his BS in Computer Science and Electrical Engineering from MIT.  Learn more at ReciprocityLabs.com.