Where are you in your GDPR journey?

At first glance, it may seem strange to be asking you where you are in your GDPR journey when enforcement for the regulation begins on May 25 — which is now less than 50 days away. After all, GDPR was approved way back in April 2016, and here at IBM we’ve been talking and blogging about it virtually ever since then.

Of course, we all know that there’s a huge difference between talking — or reading — about something and actually doing anything about it.

Last month, we discussed knowing whether you’re truly GDPR-ready. If you’ve already determined that you are ready, congratulations! But you might want to continue reading anyway just to see if there’s anything else you’d like to consider. But I’m guessing there are a lot of you who aren’t quite ready. And that’s why I started out today by asking where you are in your GDPR journey.

Yogi Berra once famously said, “If you don’t know where you’re going, you might not get there.” What’s that got to do with GDPR? Well, it’s pretty hard to get started if you don’t know what your obligations are or where your gaps are lurking. So I strongly suggest that you start with a readiness assessment. It offers a structured approach to developing a maturity assessment, gap analysis and road map that can help you see what’s most important and jump-start your efforts.

You can also take advantage of the readiness assessment for further guidance on managing your ongoing GDPR program and recommendations for additional services as you move forward. Remember, managing GDPR needs to be an ongoing, sustainable program.

In a hurry? You can start with an online self-assessment that allows you to answer a series of questions about what you’ve done so far and provides you with a customized list of the steps you can take next. What’s more, you can take advantage of an accelerator to help you identify your organization’s personal data, determine where it resides and begin to assess the security risks associated with that data.

I’ve heard many stories of well-intentioned but time-pressed security teams attempting to use spreadsheets to manage their GDPR record-keeping activities. As most of them soon discovered, spreadsheets just don’t offer a sustainable solution. Those spreadsheets aren’t always kept up to date and they’re not capable of managing or measuring risks. But the critical data protection program from IBM can help you identify and define your most valuable data, perform gap analyses, monitor your security framework, analyze and classify the most important aspects of your information, and create a risk remediation plan.

And using a data risk manager can help you identify and stop potential risks to personal data and sensitive business data that may impact business processes, operations and your competitive position. The overview page of IBM Data Risk Manager displays a world map showing the locations of your data assets so you can actually see where your important information resides. It can also help with GDPR data transfer requirements as you move information from one place to another.

In addition, GDPR mandates that you be ready to take action when the need arises.