Get Into Gear On GDPR

The introduction of the General Data Protection Regulation (GDPR) in May 2018 represents a watershed moment for data regulation. 

The Data Protection Act of 1998 will be bolstered by the European regulation that is set to reshape how organisations handle personal data with ramifications for every organisation doing business in Europe. This legislation has created a flurry of fear and confusion globally which has been building towards its enforcement date. 

Scenario planning must be front and center when a company’s finances, brand or reputation is at stake; and the GDPR is no different. 

The regulation’s legal obligations will require those businesses in possession of European citizens’ personal data to be honest, open and transparent about their digital practices, more so than ever before, protecting the rights of natural persons. Slowly but surely, organisations are waking up to the challenge, amid concerns around the potential financial implications of what failed compliance would look like.

Worryingly however, the majority of organisations are still a long way off GDPR compliance. According to a recent global survey from Veritas Software, less than two per cent of organisations currently meet the necessary requirements. It’s unlikely however that mere laziness is the cause, but rather inertia over decision-making. 

Simply getting started on the journey towards compliance is undoubtedly one of the biggest obstacles. Both the intricate nature of the regulation and its multiple parts, are likely to be the root causes for the lack of action in many companies. 
Certain measures will generate results faster than others. Our recommendation is to first examine the IT estate to pinpoint those applications most likely to be used to access personal data. A manufacturing organisation on our books has 35,000 employees that regularly use as many as 11,000 distinct software titles, both on premise and in the cloud, a significant amount of software, but no more so than any other organisation of this scale. 

But 11,000 is still a high number of software titles to filter through manually, requiring an understanding of each application, the kind of data that is likely to be accessed, where it is being accessed and by whom. 

Comparing the software inventory with those applications with identifiable potential GDPR risk alone means the organisation can focus on less than 500 applications, as opposed to the original 11,000. A seemingly impossible task now becomes manageable. 

Those who comprise the GDPR team (i.e. data, legal and SAM teams) must still be able to identify which applications are accessing what data; who was using that application, how that data is being stored and where it is located. This work is now only required for the less-than-five percent of applications that are relevant to the GDPR, as opposed to every piece of software owned by the company. 

RoPA Yourself
Those starting now must focus on what can be addressed before the deadline to make themselves a less attractive target to those regulators charged with enforcing the GDPR.  To satisfy regulators and build a plan for achieving compliance in a sensible timeframe, GDPR teams should turn to the Record of Processing Activities (RoPA) (Article 30 of the regulation), which comprises five key obligations. For those consultants launching an ‘emergency’ project for clients, they should be making it crystal clear the RoPA is essential for focus and success.

The inventory of applications is also key when creating the RoPA, enabling the GDPR team to spot and investigate any risks associated with the data. Teams internally and externally can then complete the RoPA and address any major risks head on. 

You can only do your best
The deadline of May 2018 is only the beginning, not the end. Policy makers are already under monumental pressure to smoke out prosecutable cases in the aftermath of the regulation’s implementation. As an organisation, if you cannot complete your GDPR project in time for the deadline, taking firm steps to indicate ‘best efforts’ are vital to make your organization a far less attractive target. 

Evidence that you are investigating the risks and have a continuing plan in place to mitigate them could, and should, be enough. 

Infosecurity Magazine:

You Might Also Read: 

The GDPR Advisory Board Offers Expert Advice:

The New GDPR Rules Focus On Consumer Protection:

What Does The UK’s Data Protection Bill Mean For Business?:
 

« Russian Hackers Steal $10M From Banks
Why Is The Price Of Bitcoin So High? »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Data Resolve Technologies

Data Resolve Technologies

Data Resolve offer a mechanism through which customers can detect and tackle various kinds of sensitive activities pertaining to data loss and data theft.

Privacy Analytics

Privacy Analytics

Privacy Analytics enables healthcare organizations to unleash the value of sensitive data for secondary purposes without compromising personal health information.

SafeHouse Technologies

SafeHouse Technologies

SafeHouse is a cloud-based, high-end cybersecurity platform that can secure and insure any device that is connected to it.

Westminster Insight - Cyber Security Conference

Westminster Insight - Cyber Security Conference

Join colleagues this December for Westminster Insight’s Cyber Security Conference, as you’ll assess how new technologies such as AI can secure your organisation against future threats.

OISTE Foundation

OISTE Foundation

OISTE foundation allows users to control their digital identities using well-understood and secure algorithms that ensure the continued validity of an identity and its claims.

Keysight Technologies

Keysight Technologies

Keysight is dedicated to providing tomorrow’s test technologies today, enabling our customers to connect and secure the world with their innovations.

TwoThreeFour

TwoThreeFour

ThreeTwoFour provide tailored cyber security solutions, delivered by highly-skilled, experienced consultants who respond to the real needs of you and your business.

SecurIT360

SecurIT360

SecurIT360 is a full-service specialized Cyber Security and Compliance consulting firm.

NVISIONx

NVISIONx

NVISIONx data risk governance platform enables companies to gain control of their enterprise data to reduce data risks, compliance scopes and storage costs.

Hub71

Hub71

Hub71 is a world-class tech ecosystem opening doors to global opportunities from an optimal business environment for entrepreneurial-minded innovators.

Vircom

Vircom

With a large majority of cyber attacks starting with email, Vircom provides protection against the worst email security threats to your business.

Secrutiny

Secrutiny

Scrutiny's core services include Cyber Maturity, Cyber Risk Analyser, Cyber Controls, Incident Response, SOC, Cyber Recovery and Assurance Testing.

RubinBrown

RubinBrown

RubinBrown LLP is a leading accounting and professional consulting firm. The RubinBrown name and reputation are synonymous with experience, integrity and value.

EDGE Group

EDGE Group

EDGE is one of the world’s leading advanced technology groups, established to develop agile, bold and disruptive solutions for defence and beyond.

Aurascape AI

Aurascape AI

Aurascape is working on advanced cybersecurity solutions powered by grounds-up generative AI architecture.

DOT Europe

DOT Europe

DOT Europe is a consensus based organisation which brings a diverse membership together to agree on their collective stance on EU tech policy.