5 steps to sustainable GDPR compliance

By now, organisations around the world have the European Union (EU) General Data Protection Regulation (GDPR) in their sights. They know that regardless of where they’re based, it affects them if they’re supplying products or services to EU citizens or organisations. And they know that if they don’t comply by the May 2018 deadline, it could cause serious damage. Not only hefty fines and legal costs, but also widespread business damage from a tainted reputation. 

It’s clear that noncompliance with the GDPR could be a real threat to the future of many organisations. But on the other hand, personal data has tremendous value. If it’s managed properly, it can create significant competitive advantage. Let’s look at the steps you can take to achieve GDPR compliance – and, while you’re at it, position yourself in the best way possible to get an edge over competitors.

An action plan for your journey to GDPR compliance 

The GDPR gives every EU citizen the right to know and decide how their personal data is being used, stored, protected, transferred and deleted. Needless to say, implementing the GDPR will affect your entire organisation. You’ll need to get back to the drawing board and rethink how personal data is handled from the source to the point of consumption. You’ll also need to consider how your data management and data governance frameworks will support GDPR requirements for personal data protection. 

Take the right approach to GDPR compliance

While it may sound overwhelming, there are ways to make compliance more manageable. Here are five steps that will help you on your journey to GDPR compliance. 

1. Access. The first step toward GDPR compliance is to access all your data sources. No matter what the technology – traditional data warehouses and Hadoop clusters, structured and unstructured data, data at rest and data in motion – you must investigate and audit what personal data is being stored and used across your data landscape. Seamless access to all data sources is a prerequisite for building an inventory of personal data so you can evaluate your privacy risk exposure and enforce enterprisewide privacy rules. To address GDPR compliance, you can’t rely on common knowledge or perception of where you think personal data might be. The regulation requires organisations to prove that they know where personal data is – and where it isn’t.
   
2. Identify. Once you’ve got access to all the data sources, the next step is to inspect them to identify what personal data can be found in each. Often, personal data is buried in semistructured fields. You’ll need to be able to parse those fields to extract, categorise and catalog personal data elements such as names, email addresses and social security numbers. Considering the volumes of data at hand, this cataloging process can’t be manual. And you not only need to parse and classify personal data – you also have to accommodate varying levels of data quality. Things like patterns recognition, data quality rules and standardisation are vital elements of this process. Having the right tools for the job will make a big difference in your ability to maintain GDPR compliance.
3. Govern. Getting a grasp on personal data starts with being able to define what personal data means and then share this understanding across your organisation. For GDPR compliance, privacy rules must be documented and shared across all lines of business. This is the way to make sure personal data can only be accessed by those with proper rights, based on the nature of the personal data, the rights associated with users groups and the usage context. To achieve this, roles and definitions must be established in a governance model. Then you can link business terms to physical data sources, and establish data lineage from the point of creation to the point of consumption. This provides you with the required level of control.
4. Protect. Once the personal data inventory and governance model are established, it’s time to set up the correct level of protection for the data. For GDPR compliance, you can use three techniques to protect data: encryption, pseudonymisation and anonymisation. You must apply the appropriate technique based on the user’s rights and the usage context – without compromising your growing needs for analysis, forecasting, querying and reporting. The easiest way to protect data privacy is actually to press the delete button, keeping only the data you need to run critical business processes and added-value analysis. 
5. Audit. The fifth step in your journey to GDPR compliance involves auditing. At this stage, you'll need to be able to produce reports to clearly show regulators that:

    – You know what personal data you have and where it’s located, across your data landscape.

    – You properly manage the process for getting consent from individuals who are involved.

    – You can prove how personal data is used, who uses it, and for what purpose.

    – You have the appropriate processes in place to manage things like the right to be forgotten,
       data breach notifications and more.

From GDPR compliance to risk management as a whole

Being able to create detailed reports about personal data usage is not simply a requirement for GDPR compliance; it helps you manage the risk exposure of your organisation when it comes to data privacy. The five steps outlined here can guide you as you put in place the technologies, processes and people necessary for sustaining GDPR compliance and managing risk as a whole. What’s more, it can strengthen your business, create deeper bonds with customers, and spur innovation that could have positive, far-reaching implications for future growth. 

About the Author

Olivier Penel is a senior adviser with 15 years of information management consulting experience for Global 1000 companies across various industries. In leadership positions at companies such as IBM and Infosys, he led distributed teams of data management domain and technical experts in supporting sales initiatives and pre- and post-sales engagements. Penel has shared his expertise in data management best practices with many audiences during speaking engagements. His goal is to help organisations build a holistic strategy and value-driven road map for data governance that spans traditional data management practices – data integration, data quality, MDM, virtualisation – along with big data, BI, analytics and decision management.