Keeping a compliant Data Processing Inventory creates a set of challenges that often leave companies disheartened, overwhelmed and delaying the start of the project.
The main organizational challenge is the lack of cooperation between Data Protection Officer, Legal Services, IT, HR and Marketing, which is understandable given the complexity of the project and the variety of functions and departments involved.
However, without cooperation, there is no division of responsibilities between departments, which means a DPO should possess both technical expertise in order to implement compliance policies and understand data protection laws.
The reality is that the DPO is usually an IT professional or legal expert, not both. Even if there would be a DPO who embodied both expertise, it is almost impossible for one person to have continuous insight into the regulatory segment and the data segment of all the company’s business processes, and the larger the scale, the more complicated it gets.
The Inventory represents one of the main compliance pillars that should give you an overview of procedures and important information about data processing. Still, the record is usually kept in Excel, which does not offer collaboration function and a DPO cannot track changes made in the document.
Moreover, it is impossible to administer other applicable laws or define data retention policies for each data category, because Excel does not allow you to execute those policies directly onto the appropriate data sets.
These challenges prevent companies to move forward with their compliance project. If there is no division of responsibility between DPO and other organizational units, the DPO will face the impossible challenge of overseeing all processes.
On the other hand, if the company has recognized the importance of decentralized data privacy management model and there is a collaboration between departments but there is no proper tool for managing the processes, the DPO will be left without an overview of all processing activities and unable to track changes made by other departments.
Data Privacy Manager facilitates collaboration between DPO, Legal service, IT, HR and Marketing, allowing them to create clearly defined responsibilities that are achievable and consistent with the competencies of each organizational unit.
Division of responsibilities means that a DPO has a continuous insight into the legal, regulatory segment and the data segment of all business processes of the company, advising Marketing and HR during the compliance process, while IT is resolved from in-depth understanding of data protection law and focused on the implementation of the policies.
Data Protection Officer has access to all processing activities and their changes, while other roles can create, edit, and (de)activate processing activities. Each processing activity has its owner that indicates who is responsible for updating information related to processing. These functionalities make record keeping in Excel obsolete.
Decentralized data privacy management model seals the DPO as a supervisory and advisory role, while IT, Marketing, HR and other departments take responsibility for their part of the compliance process.
This makes automatization of entire personal data lifecycle possible, which is the only way to be truly compliant considering the amount of data that is being processed, the number of IT systems that process data, and represents the bases for automatization of all further compliance processes.
Business Process
(Original Purposes)
Data Retention
(Purpose change)
No Purpose
Business Process
(Original Purposes)
Data Retention
(Purpose change)
No Purpose
While Organizations have been busy collecting consents and putting together compliant Records of processing activities, the data removal remained overlooked, or maybe postponed? Most of the Organizations have by now documented data retention policies and have a good idea about how long they can keep the data. Data retention starts when one of the following scenarios happen: The initial purpose for data collection and processing has expired. Usually, a product or services contract with an individual has expired, an insurance policy has expired or individual stopped using a product or a service…
What do you have to take into account when managing privacy risks? Can you really avoid all risks? Might there
Data processing inventory is in the heart of every privacy program because it all starts with understanding and recording personal
Privacy programs are yet to be established in many organizations and require further encouragement from the management. We shared 5 basic
General Data Protection Regulation (GDPR) requires that Organizations processing personal data (Data Controllers and Data Processors) maintain a register of
Data processing inventory is in the heart of every privacy program because it all starts with understanding and recording personal
Communicate with your contacts in a GDPR compliant way The application of the GDPR principles in modern digital and direct marketing has
Services
Resources
Latest blog posts
Latest blog posts