Countdown to GDPR: Checklist to Get Your Infrastructure Compliance-Ready

In a world constantly bombarded by ransomware, viruses, and other data breaches, people want to feel that they and their data are protected. As such, the EU’s General Data Protection Regulation (GDPR) compliance law has caused quite the buzz since it was approved in April 2016. In short, GDPR ensures data protection for any EU citizen. Starting in May 2018, GDPR will require companies within EU countries and any company that sends or retrieves data from EU countries, to comply with new regulations involving data protection and data security. (Yes, that means any global enterprise based outside the EU as well!)

Compliance regulations are not new. In fact, companies work to ensure numerous compliance regulations are met every year. However, according to a PwC Pulse Survey of C-suite executives from large multinational corporations, 54% of respondents reported that GDPR readiness is the highest priority on their data privacy and security agenda. And 77% plan to spend €1 million or more on GDPR compliance. Why are businesses spending so much time and money getting ready for GDPR? First, GDPR actually benefits businesses because it reduces red tape by consolidating the previous 28 laws to just one. This consolidation brings companies an estimated €2.3 billion per year in cost savings. Second, failure to comply with GDPR after May 2018 comes with hefty fines of either 4% of the company’s global revenue or €20 million, as well as a damaged reputation and potential lawsuits.

But what about the other 46% of businesses who haven’t started planning for GDPR? With less than a year before the regulations are enforced, there is still time to plan, revise policies or invest in new technologies – but time is of the essence. To ensure you are ready to comply, consider the following to-do list:

1. Improve data governanceSpecifically, you must be able to report how personal (structured and unstructured) data is being leveraged, collected or even edited, including having processes in place that allow EU citizens to easily grant, review, and reject that data. You also need to ensure your infrastructure can keep track of these authorizations and the data lifecycle.

2. Monitor data access Speaking of authorization, you need to establish employee access authorization policies to limit access to data and ensure privacy. These policies must be constantly updated to reflect organizational need and monitored for breaches.