In December 2015, the European Union (EU) announced a framework designed to combine the various data protection laws throughout the region. The General Data Privacy Regulation (GDPR) impacts many industries, from coffee shops to football clubs. It essentially affects any institution that retains personal information, especially businesses that store or handle data in multiple countries. In this digital age, our end users could be anywhere.
New Challenges Under the GDPR Compliance Regulations
Preparing for the GDPR compliance regulations is a companywide challenge, not just for the ops and compliance teams. The regulation will broaden the scope of what qualifies as personal and sensitive information when it takes effect in May 2018, requiring security teams to review how they store and encrypt this data. Additionally, companies will be required to produce copies of any customer data it collects upon request.
Under the GDPR, companies must report data breaches to the Supervisory Authority (SA) within 72 hours. This will require chief information security officers (CISOs), chief technology officers (CTOs) and legal teams to review or create processes and procedures and adopt new technologies. To remain compliant with the GDPR, IT leaders must equip their security ecosystems with effective identity and access management (IAM), encryption, log management and incident management tools.
Preparing for the GDPR
To prepare for the GDPR, executives, employees and managers must understand how it impacts operational practices at every level. Cloud operations managers must determine what personal data they are currently storing, where it lives, how it flows within the organization and how it is secured. Determine how personal data is shared and whether third parties will need to access it.
It’s important to review all data retention schedules, cross-border data transfers and privacy notices. IT managers should also work with the lines of business to review data subject consent and choice mechanisms. Then they determine how to respond to access, correction and erasure requests.
Organizations must take these steps as soon as possible or risk paying up to 4 percent of their annual revenue for violating the GDPR compliance regulations.
Read the Interactive Solution Brief: Ready, Set, GDPR