What Your Board Needs To Know About GDPR

Executives in businesses around the globe have been tracking The European Union's (EU) General Data Protection Regulation (GDPR), which goes into effect 25 May 2018. Those who operate primarily in the EU have had plenty of time to focus on this and no excuses for not paying attention. 
 
Those who operate primarily elsewhere also have no excuse to not be aware of the GDPR and should have already assessed how things should change because of these new rules. 
 
We have found, however, that many firms in the EU and the US and elsewhere are still not paying enough attention to these very serious rules. 
 
The objective of these new rules is to improve privacy and security of critical personal information. The rules are also designed to harmonise many different rules active across Europe and this should make overall compliance easier. 
But still, for most, compliance will require changes be put into place for how data is stored and also changes put in place for how people can be put in control of their own data. 
 
Remember, the GDPR is not just about firms that operate in the EU. It applies to firms that have data on EU citizens. 
The GDPR requires that to collect info on EU citizens, the citizens must give their consent and the citizen also has the right to be forgotten. The data it applies to is broad, including even IP addresses.
 
At this point, just 20 days away from the compliance deadline, we recommend all firms do three things:
 
1. Read the rules yourself. They are not that hard to read and think about
 
2. Consult outside counsel. Pick a law firm you know and trust and ensure they have knowledge of the GDPR. Ask us if you need some recommendations.
 
3. Seek an external review of your technical architectures for compliance. Our firm, Crucial Point, is a good place to start here.
We recommend that Boards (including Audit Committees for those that have them) should evaluate their company's data retention activities and policies to see if they are in need of modification to comply. 
Boards should ask CEOs and the management team to assess where exposure to GDPR non-compliance is greatest and prioritise actions to fix. 
 
Boards should ask questions to determine if line of business leaders realise they are responsible for compliance vice just assuming this is an IT function. And boards should know who the Data Protection Officer (DPO) is for the firm.
 
Here is more on the GDPR:
 
• Fines for non-compliance are up to 4% of annual revenues.
• Customers must consent for processing of their data
• Personal data must be protected. This includes anything related to a natural person or anything that can be used to indirectly identify the person. This includes names, photos, email addresses, bank details, addresses, posts on social media sites, medical info, IP addresses
• The rule describes a new position, a Data Protection Officer (DPO), which will be required for firms that do large scale monitoring or processing of sensitive data
• Consent of users is required and it must be asked for and granted in specific ways before collecting and processing data.
• Citizens are given new authorities over their data including right to have it removed (a right to be forgotten)
• Data protections are expected to be designed into systems
• If there is a breach of personal information, the citizen will be notified and impact assessments done
• Transfer of data to other countries and organizations is regulated
• Companies are expected to maintain a state of the art cybersecurity architecture and posture
 
We can accelerate your compliance with GDPR and do so in a way that helps your security posture. 
 
CTO Vision
 
To contact the GDPR Advisory Board please click HERE:  
 
You mIght Also Read: 

The Pitfalls Of GDPR & Cyber Security For Micro Organisations:
 
Cybersecurity Advice For SMEs:
 
« A Guide To Preventing Charity Cybercrime
Meet Tess: The Mental Health Chatbot »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

OCERT

OCERT

OCERT is the National Computer Emergency Response Team of Oman.

Markel International

Markel International

Markel International is an international insurance company which looks after the commercial insurance needs of businesses. Specialist services include Cyber Risk insurance.

Experian

Experian

Experian provide software solutions to help organizations prevent identity fraud and crime.

CTR Secure Services

CTR Secure Services

CTR Secure Services provides a broad range of security consulting services from asset protection to cyber security.

SecureNinja

SecureNinja

SecureNinja provides professional training, certifications & professional services related to all facets of Information Technology and Cyber Security.

Ritz

Ritz

Ritz is the largest holistic pure-play cyber security solutions provider in Myanmar.

Kingsley Napley

Kingsley Napley

Cyber crime is an area of growing legal complexity. Our team of cyber crime lawyers have vast experience of the law in this area.

SlowMist

SlowMist

SlowMist is a blockchain ecosystem security company providing cybersecurity audits and protection for leading digital asset exchanges, crypto wallets, public chains, and smart contracts.

Fly Ventures

Fly Ventures

Fly Ventures is a seed-stage venture capital fund for outstanding teams building Enterprise and Deep Tech startups in Europe.

Pacific Cyber Security Operational Network (PaCSON)

Pacific Cyber Security Operational Network (PaCSON)

PaCSON is an operational cyber security network of regional working-level cyber security experts in the Pacific.

Mitnick Security

Mitnick Security

Mitnick Security is a leading global provider of information security consulting and training services.

Trisul Network Analytics

Trisul Network Analytics

Trisul helps organizations deploy full spectrum deep network monitoring which can serve as a single source of truth for performance monitoring, security analytics, threat detection and compliance.

Appurity

Appurity

Appurity specialises in mobile and application security, delivering comprehensive solutions across all verticals.

QA Consultants

QA Consultants

QA Consultants is North America’s largest software quality engineering services firm, an award-winning onshore provider of software testing and quality assurance solutions.

Cybit

Cybit

Cybit is the one-stop-shop for digital transformation that scales in line with your growth.

Neeve

Neeve

Neeve is an edge cloud platform transforming smart buildings and spaces, making them more secure, smarter, and more sustainable.