ChatGPT
Perplexity AIA new report from W8 Data reveals that only 25% of existing customer data meets the requirements specified under the EU’s General Data Protection Regulations (GDPR). At the same time, the GDPR enforcement date is at the time of writing only 129 days away. In the legal departments of European organizations, one question is yet to be answered: Is it time to panic? In this article we’ll look at common GDPR myths, and a timeline to compliance.
Common Myths About GDPR Compliance
Before we go into a timeline for the preparation work, it’s good to clarify some common myths and misunderstandings about the GDPR.
Myth 1: All or Nothing Fines
Many think that the actual risk connected with GDPR compliance is small. Others believe that a breach of the regulation will result in an immediate 4% of revenue fine. The truth, as always, lays somewhere in between. GDPR will without a doubt be enacted and companies will be fined for their breaches. The first organizations to be reviewed are most likely those who a) Eecently had a security breached that resulted in the uncontrolled/illegal circulation of personal information or, b) Organizations who have a bad reputation of following previous/current EU laws/regulations or, c) Generally well-known/widely established/highly profitable organizations who store large amounts of sensitive data.
Myth 2: Compliance is a One-and-Done Matter
Organizations tend to talk about the GDPR like the Y2K problem. It’s a doomsday moment that will occur at a specific timestamp and then never happen again. This couldn’t be more incorrect. If you fail to comply with the GDPR on the 25th of May 2018 the sky won’t fall down. The GDPR should be viewed as the new status quo, and an ongoing process to comply with This is the new reality that organizations all over Europe will have to adapt to, or pay the price.
Myth 3: No Breach Means No Problem
Another common myth is that the regulation will only apply to organizations that have fallen victim to a security breach that violates user’s personal data. This is unfortunately not the case. A public breach will be a red flag that most likely will result in an audit, but it will not be the only reason for investigation. All companies will be expected to comply, regardless of whether breaches take place.
The First 4 Steps to Achieving GDPR Compliance
Now that we’ve discussed some of the myths that surround GDPR compliance, it’s time to talk about the preparation work. To make it easier, the implementation of the GDPR has been broken down into four general steps.
Step 1: Current Situation (Gap) Analysis
This first step is all about understanding Your organization and the gap between the current status of data protection compliance and the obligations that comes with the introduction of the GDPR. Questions you need to answer is what kind of departments in your organizations that process what kind of data and for what purposes, how are data subjects protected, are there clear roles and responsibilities implemented, what IT security rules and measures are in place and much more.
Step 2: Risk Analysis
You can’t be compliant with GDPR in one giant move. The scope is just too big. Therefore, a risk analysis has to be executed. What data processing activities are of biggest risk to a) the organization’s business and/or b) rights of the data subjects? This is a good foundation for the risk analysis of your specific organization. This result will then be matched against the risk of the highest fines. To be able to perform this risk analysis you either need to a) Go through your whole software portfolio manually, or b) Acquire a software that will automatically detect your risk software and/or computers/servers that might have increased risks for a security breach.
Step 3: Project Planning
The implementation of the GDPR will require an organization-wide collaboration with mainly the European entities involved. It is very important to have an awareness of the project spread to the organization’s C-level management, with all the necessary actions communicated.
Clear roles and responsibilities should be assigned to all the involved EU offices, as well as designated project manager lead, leading the project from a central point.
At this time resources need to be allocated and planning should cover things such as internal resources (personnel, software etc.), costs, and legal impact.
Step 4: Implementation
There are some key elements that needs to be implemented when it comes to the implementation step, such as:
Defined roles and responsibilities: Clear roles at the local offices (as well an accountable project lead at the HQ) should be in place to easily give and execute data protection orders and communication of data protection related matters
Procedures and concepts: Many GDPR obligations can only be implemented if respective concepts, policies and standard operating procedures are first in place, for example regarding breach notifications, Data Protection Impact assessments, data subjects’ rights etc.
Education/training: One of the key factors is spreading knowledge about the GDPR within the organization. Employees should be training about their rights, obligations and responsibilities deriving from the GDPR.
Documentation: All measures implemented to demonstrate compliance with the GDPR requirements should be documented, reviewed and updated regularly.
A Compliance Timeframe
So, what kind of time frame is expected achieve GDPR compliance? Counting 2 months per step, with an extra timeframe for the later steps is realistic. This would look like a 2-2-4-4 approach for the four steps, which gives a total implementation time of 12 months.
It’s worth noting that both these timestamps of course are highly general, and the actual numbers will fully depend on the size of company, the complexity of infrastructure, the software/policies/roles in place etc. What we can say, looking at the estimated time frame above and the GDPR enforcement date only being 129 days away, is that your organization’s work should already be well on the way.
How Xensam’s Technology Can Support GDPR Compliance
Together, our intelligent Xearch Agent and Xource Database have a library of more than 495,000 applications, including 90,000 we-based SaaS applications. Our Xource Technicians are constantly increasing our numbers to bring greater visibility to our users. Our software software normalization provides information on the GDPR compliance of applications in addition to other critical metadata like license requirements, release date, EOL, up-and down-grade paths.
Tracking Risky Applications: Xensam’s technology detects applications that could cause a potential GDPR risk. These are mainly apps that in one way or another could be storing or processing personal data in a realistic and common use scenario.
Classification Coverage: The Xource Database doesn’t only classify the risk of applications, but also tracks what vendors have made statements about their GDPR compliance, EU Data Protection Directive, and EU-U.S. and Swiss-U.S. Privacy Shield Frameworks.
Tracking Risky Computers and Users: Xensam tracks the devices on which GDPR risky software is installed, what type of computer it is, where they are located, and which users have accessed it, and what kind of GDPR risk the application has. The system will also track if the computers/users might be high risk objects for security breaches due to lack of anti-virus, firewalls or if they have malware installed on their devices. All this data is dynamically presented in list views which are filterable, editable and exportable. Xensam’s platform offers numerous pre-built reports that provide an overview of potential GDPR risks. You also have the ability to set up automatic alerts that will notify when risky applications are installed. Learn more about automated blocklist notifications here.