How to start your GDPR compliance journey

General Data Protection Regulation turned the business world upside down with requirements on how to process personal data of EU subjects forcing companies to reconsider their policies, adopt new procedures, and change the way they operate.

The question of becoming GDPR compliant will always be relevant since it is an ongoing process. You will never be done with compliance. New companies will appear on the market, or the existing ones will expand their operations to EEA or change their processes.

However, that doesn’t mean you shouldn’t strive to achieve it. We now know that companies that invested in their privacy programs have achieved impressive ROI and secured an upper hand over their competition.

They are also more immune to privacy-related risks and can offer better customer service to their clients, with improved cybersecurity, better marketing, and higher quality of data.

One more reason why GDPR acquired so much attention is the fines for a violation of GDPR. They are quite substantial and vary depending on the severity of the infringement starting from €10 mil  (or 2% of the worldwide annual revenue, if it was higher than this sum for the preceding year) and reaching €20 mil (or 4% of the worldwide annual revenue).

Conducting the audit

The first step is defining what is the status of compliance in your organization at the moment. To do so, a preliminary GDPR audit is required that will assess your systems, activities, records, processes, and data protection practices.

The GDPR audit is usually conducted by privacy professionals or consultants and aims to provide you with the full picture of the state of your compliance, as well as to outline critical flaws in your systems and policies, help you detect the security of your systems, and identify your data processing activities, as well as provide recommendations on the required changes.

However, compliance is a marathon, not a sprint, and it is important to remember that everything you do now (the policies you implement, databases you clean up, or processes you establish) has to function in a year, two, and longer, so approach your privacy program with forethought.

Defining the project scope

After the audit is done and all the problematic areas are outlined, it’s possible to create an action plan and list of what needs to be changed and which departments need to be included in the project. Usually, this will involve departments where personal data is being processed (HR, Marketing, Legal,…)

Defining project scope allows you to break down a GDPR project into small doable chunks prioritizing the most problematic areas and dividing the scope between several teams so that several streams are going in parallel with other changes.

A DPO (or anyone who is in charge of privacy program in your company) should be responsible for overviewing the entire process and provide guidance and assistance if needed.

Automating processes

In order to continue your business practices in a compliant way, you will have to consider automating your processes and using specialized privacy software to help you accelerate the pace and success of your privacy program.

As we mentioned before, your privacy program should ideally resist the test of time and be scalable (nothing is set in stone).

We adopted a four-phase approach that can help your company build a robust and scalable privacy program and includes data discovery and classification, digital transformation of the privacy program (automation, collaboration, and risk management), consent and preference management, and data removal orchestration.

Find out more: 4-phase approach to advancing your Privacy Program

Personnel-related activities

1. Training

Not everything related to GDPR compliance is about systems and software. Company culture is equally important.

During the project, one of the most important streams is personnel training, so here you need to foster a culture of privacy and security awareness, paying special attention to the less tech-savvy employees.

Enrolling in the cybersecurity courses chosen by the company may be the best way for those who do not know where to start. Learning the first steps of safe internet conduct, like opening suspicious emails and any attachments, file types with malware, and how to recognize a social engineer, will give people the ground for further learning.

Usually, villains use human weaknesses to get personal customers’ data, and when the data are subjected to GDPR laws, the consequences of such leakages could be disastrous.

When it comes to the more precise GDPR-related training materials, here are several great Udemy options:

• GDPR in 30 minutes. As the title suggests, this course is for busy people, as all the information about the regulations and requirements is squeezed into 30 minutes. It will get users acquainted with the basics. So, it’s a great way to start learning GDPR here.
• GDPR Privacy Data Protection CASE STUDIES (CIPT, CIPM, CIPP). This course is for a more advanced audience, e.g. acting data protection officers or cybersecurity techs, as well as for all those who already know the GDPR fundamentals and want to see how to apply the knowledge of the procedures into everyday security practice and enhance the security workflows within the company on the illustrated examples.

2. Developing new internal policies and workflows

With adopting the new working tools and changing the terms of processing personal information of individuals, your established workflows will need to undergo changes.

The new processes, like personal data deletion workflows and managing the data processing inventories, will need to become a part of routine work.

If you have a customer support team on the front line, like calls and chats, they will need to learn new procedures and follow the updated scripts on answering questions about GDPR compliance or answering data subject requests.

3. Proper communication

Proper communication of new rules is key to success. The more transparent your communication with employees, the higher the chances for faster adaptation.

There’s no other way to conduct business with subjects of the European Union than by following GDPR policies. So you need to properly communicate the company’s plans to those who will be directly impacted by these new changes.

This communication usually includes company-level meetings with employees, regular email updates, and reiterating how the project is going on 1:1 calls.

Q/A sessions where all your team members will have a possibility to raise their concerns and ask all the important questions will not only facilitate GDPR adoption but also may help to identify risks that you haven’t thought about.

4. Internal Checks

In order to check if the organization is ready to process GDPR-related requests, it will be required to test if the employees properly follow all the procedures.

It should include simulating several use-case scenarios as if they are coming from real data subjects to see how your staff can handle them.

Such internal checks will be an opportunity to assess the level of preparation, and getting some failures here will be an indicator that additional training is required. It’s better than facing a real failure that may translate into the enormous fines mentioned above.

However, you also need to enable your employees to be able to respond to those requests from a technical perspective. For example, if they need to respond to the “right to be forgotten,” they will need software that can locate all personal data you hold about the individual and be able to delete that data from your systems.

Wrap-up

GDPR compliance is a very complex topic and an ongoing process. It is extremely important to note that every company has a different starting point and its own set of needs when it comes to compliance. Your journey may look a lot different, and that’s ok as long as the end result is the same.

It is important to note that you need to focus on both organizational and technical measures you need to implement in order to stay compliant.

Along with new privacy laws coming into action, many software vendors have started offering digital products compliant with personal data protection. Implementing these compliance solutions will reduce the efforts in following the procedures at the same time adhering to all the requirements.

While the transition may not be easy, it’s definitely worth it, as data protection laws are not going away anytime soon.