“People and Platforms” – How to Thrive in the New Age of GDPR
The pending General Data Protection Regulation (GDPR) is set to have a dramatic impact on businesses across Europe. To make certain of compliance by the time GDPR enters into application in May 2018, organisations need to take action now to ensure they are adequately capturing, integrating, certifying, monitoring and of course, protecting their data.
There is a lot to do. Many organisations across both public and private sectors have not yet given due consideration to the problem, let alone taken proactive action to prepare themselves for full compliance with the new ruling, which was introduced by the European Commission on May 4, 2016.
They will not be able to put this problem on the backburner for much longer, however. A failure to comply with the new regulations could be costly. Breaches of some provisions could lead to data watchdogs levying fines of up to €20 million or 4% of global annual turnover for the preceding financial year, whichever is the greater.
When GDPR comes into force, businesses will need to track and trace each and every piece of potentially sensitive data, and determine how it is processed across their entire information supply chain – from their CRM and HR systems to their Hadoop data lakes. This same careful data management will be required to comply with “privacy by design” principles, which means that each new digital service that makes use of personal data must take the protection of such data into consideration, for example, by considering data anonymization or pseudonymization.
Compliance with GDPR is also dependent on the organisation’s data agility, as it mandates to communicate transparently with data subjects on their personal data and grants them rights for data access, as well as rectification and erasure at any time, free of charge. This can be a particular challenge for large, complex or geographically dispersed organisations where data is often siloed, duplicated and distributed across many different sites and likely stored in multiple places. Any delays to answer requests can be a major problem for businesses if they don’t have a clear process and widely accessible system to compile the requested information.
Businesses today are faced with the proliferation of data together with multiple new cloud and digital applications. It is therefore becoming increasingly difficult for IT departments to take total ownership of the protection of personal data without engaging their counterparts in HR, Sales, Marketing, and other customer-centric business units.
However, for most companies, GDPR mandates the appointment of a Data Protection Officer (DPO). Their role is to educate, advise internally on the obligations under the regulation, monitor compliance, and cooperate with the supervisory authority.
