As we edge closer to the one-year anniversary of the implementation of GDPR, many organisations are still struggling to achieve compliance with the landmark legislation.
In fact, a recent study conducted by Forrester found that over half of the respondents had not taken all the necessary steps to achieve compliance, despite the passing of the May deadline.
Complying with the legislation has proved a lot more challenging than some organisations had initially anticipated. There are often huge amounts of data spread across a wide variety of platforms, endless access points and an increase in data requests has placed extra pressure on organisations that are struggling to get their house in order.
Demonstrating compliance with the GDPR is an ongoing process and organisations will need to continually identify and address privacy and security risks to ensure they are on the right side of the law and not liable for the large fines that could be imposed as a result of non-compliance.
Since May last year, 91 fines have been issued for GDPR violations but the €50 million fine issued to Google has emerged as the largest to date. The bigger organisations have been hit hardest by the financial sanctions but for the majority of businesses, the impact has yet to be felt.
Yet, the consequences of non-compliance are very real and if organisations fall foul of the legislation they could face crippling fines, damage to reputation and an increased risk of cyber attacks.
However, there are a number of steps that organisations can take to ensure they are on the right path to GDPR compliance:
Top tips for GDPR Compliance
1. Conduct Regular Audits and Risk Assessments
The GDPR specifies that organisations must conduct regular audits of data processing activities and comply with a set of data protection principles that will help safeguard data. Organisations will need to determine:
- What data is being collected?
- Where is the data being sourced?
- Why is the data being collected?
- How is it processed?
- How long is the data retained?
- Where is the data being transferred to?
- Is all the data needed?
- Who has access to the data?
To prevent data breaches, organisations should minimise access to sensitive data and reduce the number of places where data is physically stored.
By conducting regular audits, organisations can ensure that a suitable framework is in place to keep the personally identifiable information of customers secure and mitigate any risks.
2. Staff Awareness Training
The GDPR states that employees need to receive regular information security staff awareness training. This training is key to ensuring that staff are knowledgeable about company policies, regulations and the legal requirements that apply to their day to day role.
Organisations need to prove that staff have both read and understood GDPR Policies. Being able to provide this evidence puts organisations in a strong position to demonstrate that ‘Privacy’ has become an integral part of their day to day business. eLearning is one of the best ways to ensure that staff fully understand GDPR policy.
3. Implement an Effective Policy Management System
Compliance can prove an impossible task using existing methods of communication such as email and corporate intranet. However, through the use of policy management software, organisations can streamline internal processes, demonstrate compliance with legislative requirements, and effectively target the areas that present the highest risk to data security.
A policy management system provides organisations with an easy to use, centralised solution for creating, storing and distributing important policy documents. An effective policy management system will have a consistent method of creating policies, adds structure to company procedures and makes it easier to track compliance.
4. Create an Incident Response Plan
Under the GDPR, all organisations must disclose any personal data breaches to the relevant supervisory authority within 72 hours of detection. To effectively comply with this request, organisations need to have a plan in place that enables them to respond to any incident in a fast, planned and coordinated manner.
The plan should outline what steps need to be taken and specific individuals within the organisation should have defined roles and responsibilities to effectively make decisions and manage the situation accordingly.
The establishment of an incident response plan will help educate and inform staff, improve organisational structures, improve customer and stakeholder confidence, and reduce any potential financial impact following a major incident.
5. Defend all Access Points
To achieve full GDPR compliance, organisations must ensure that all endpoints are protected. Unfortunately, a large number of preventable data breaches are a result of unpatched systems. New vulnerabilities are discovered all the time and unless patches are applied, hackers will exploit these vulnerabilities to break into a network.
To demonstrate compliance with regulations, organisations need to show they have taken all the necessary steps to secure their systems. Auditors may require reports of what patches were applied and when, so it’s vital that organisations have the correct systems in place to accurately document what patches have been issued. Patches are essential in keeping machines up to date, stable and safe from malware and other threats.
MetaPrivacy has been designed to provide the best practice approach to data privacy compliance. Contact us for further information on how we can help your organisation improve its compliance structure.
DISCLAIMER: The content and opinions within this blog are for information purposes only. They are not intended to constitute legal or other professional advice and should not be relied on or treated as a substitute for specific advice relevant to particular circumstances, the Data Protection Act, or any other current or future legislation. MetaCompliance shall accept no responsibility for any errors, omissions or misleading statements, or for any loss which may arise from reliance on materials contained within this blog.
