Empowering the right employees to maintain GDPR compliance

Unless you live off the grid, you have probably recently received a flood of notifications from companies worldwide about updates to their privacy policies. These are the result of the launch of Europe’s new personal data privacy rules, the General Data Protection Regulation.

The high-level goals of GDPR are things that most companies would support in the abstract, notably privacy controls for customers, and a single clear set of government policies for sharing data across European countries. Like it or not, GDPR is critical for most companies: the penalties for being out of compliance can be enormous.

Now that the date for policy announcements has passed, the ongoing work begins: companies must make sure they are “walking the walk” with respect to data privacy.

As any company with a significant customer base knows, this is a complex and expensive undertaking. The responsibility to manage personal data in a compliant manner spans numerous tasks, including discovering where Personally Identifiable Information (PII) actually exists in your data, transforming data for GDPR compliance (e.g. via masking, pseudonymization or encryption), identifying all “flows” of the raw PII data into processes and assessing whether those processes violate the principles of the agreement.

Achieving and maintaining the goals of GDPR requires more than changes to software; it also requires appropriate alignment with people and processes.

In our experience, compliance is best achieved organizationally via a balanced collaboration between your domain experts (who understand your customer data) and the maintainers of your central data governance function (who understand your data stores and data pipelines).

To that end we recommend two important best practices to help your organization get on the road to maintaining GDPR compliance.

Enlist your domain experts to get the right eyes on the right data

PII can vary widely in its representation across use cases: e.g.