January 16, 2018 By Adam Nelson 4 min read

Here we are at the beginning of 2018. And with the start of a new year, we often find ourselves thinking about making changes both big and small. So it seems especially fitting to turn our attention to the Transform phase of the IBM Security General Data Protection Regulation (GDPR) framework.

The goal here is to reach at least a minimum level of readiness before GDPR comes into effect on May 25, 2018. Ideally, that would include being ready to produce a privacy risk impact assessment. That’s one of the first items a regulator is likely to want to see — along with the assurance that you have validated processes and activities in place to sustain or refresh its status.

A secondary goal would be to demonstrate your readiness to address the GDPR Article 30 requirement for records of processing. To do so, you would need to at least be able to provide a summary inventory or catalog of the personal data that’s relevant to your business — including information about where it’s stored and processed and its lineage.


Start Slowly

In our two most recent blog posts, we discussed the process of deciding what you need to do and how you can do it. You’ve made some of the important decisions and it’s likely you’ve developed a plan. Now you should be ready to start implementing that plan. Note that I used the word “start.” That’s because the Transform phase is all about beginning to make your transformation toward GDPR readiness. It’s a slow and controlled rollout that allows you to take an incremental approach to making the changes you’ve deemed necessary.

Clearly, it’s not time to flip the switch just yet. But it is a good time to recognize that there may be problems. In fact, that’s the reason the Transform phase is one of the key elements of the framework. It gives you an opportunity to tease out the problems and determine what works and what doesn’t — in a controlled environment. Think of it as a road test on a closed track where your mistakes can be easily detected and aren’t likely to result in catastrophes.

Where to Begin?

In terms of GDPR privacy requirements, this is where you begin to implement and execute policies, processes and technologies, including those related to data subject access requests. And to meet GDPR security requirements, you should be starting to implement privacy-enhancing controls such as encryption, tokenization and dynamic masking.

You should also consider implementing required security controls, including access control, activity monitoring and alerting. In addition, you may need to mitigate any access risks and security vulnerabilities that you discover.

What Exactly Will You Be Transforming?

If you’ve already worked through the Assess and Design phases of the framework (which is likely at this point), you should have the answer. During those two phases, you would have identified your targets, decided your metrics, focused your team and agreed on a plan — because it will take a united effort to move forward.

Now is the time to start rolling out your new processes and procedures for meeting the GDPR privacy requirements. Start with a few and see what works for your organization.

At the same time, you can start rolling out your security-enhancing controls. Test them with a pilot team and determine what’s useful. And keep in mind that these may be major changes for some parts of your organization, which makes it your job to see that the transition to new policies and procedures goes as smoothly as possible.

How to Succeed

Frustration can come easily when you’re making a lot of significant changes to the way things are done. And while there isn’t any single right way to navigate the Transform phase, consider what I view as best practices to help you avoid unnecessary conflict at this point. Here’s a list of the most important ones:

  • Pay attention to your stakeholders. They’re the ones in the best position to spot problems and propose workable solutions.
  • Start with a solid project plan. That can help you identify potential issues and pitfalls before they impact the entire process.
  • Station a good team on the ground. They should be able to both see the big picture and know when to zoom in on the details.
  • Insist on active participants. You need a team of doers who are ready and eager to both do the work and communicate constantly.
  • Cultivate executive leadership support. It’s good to have the C-suite on your side when you to need to make some tough decisions.
  • Set expectations. You know this is going to be a slow process and that things may go wrong; make sure everyone else knows it, too.
  • Communicate your vision early on. Be clear about what you want to see happen and about how you’ll define success.

So, yes, GDPR requires making a lot of changes. And, as you’ve likely figured out, some of those changes can be pretty complicated. But as we’ve been saying for some time now, with a clear understanding of what you need to do and a plan for doing it, you can resolve to make those changes happen.

Learn more about how IBM can help you navigate your journey to GDPR readiness with privacy and security solutions here and within a broader perspective at ibm.com/gdpr.


Notice: Clients are responsible for ensuring their own compliance with various laws and regulations, including GDPR. IBM does not provide legal advice and does not represent or warrant that its services or products will ensure that clients are in compliance with any law or regulation. Learn more about IBM’s own GDPR readiness journey and our GDPR capabilities and offerings to support your compliance journey here.

More from Data Protection

The compelling need for cloud-native data protection

4 min read - Cloud environments were frequent targets for cyber attackers in 2023. Eighty-two percent of breaches that involved data stored in the cloud were in public, private or multi-cloud environments. Attackers gained the most access to multi-cloud environments, with 39% of breaches spanning multi-cloud environments because of the more complicated security issues. The cost of these cloud breaches totaled $4.75 million, higher than the average cost of $4.45 million for all data breaches.The reason for this high cost is not only the…

Data residency: What is it and why it is important?

3 min read - Data residency is a hot topic, especially for cloud data. The reason is multi-faceted, but the focus has been driven by the General Data Protection Regulation (GDPR), which governs information privacy in the European Union and the European Economic Area.The GDPR defines the requirement that users’ personal data and privacy be adequately protected by organizations that gather, process and store that data. After the GDPR rolled out, other countries such as Australia, Brazil, Canada, Japan, South Africa and the UAE…

Third-party breaches hit 90% of top global energy companies

3 min read - A new report from SecurityScorecard reveals a startling trend among the world’s top energy companies, with 90% suffering from data breaches through third parties over the last year. This statistic is particularly concerning given the crucial function these companies serve in everyday life.Their increased dependence on digital systems facilitates the increase in attacks on infrastructure networks. This sheds light on the need for these energy companies to adopt a proactive approach to securing their networks and customer information.2023 industry recap:…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today