Where to start with GDPR?

The EC has introduced the General Data Protection Regulation (GDPR), a new regulation unifying rights, responsibilities, reports, protection and, unfortunately, also penalties regarding personal data handling.

Even though the GDPR may look complicated, there is a simple way of creating a roadmap of becoming compliant with the GDPR and avoiding future problems. The EU values personal rights and therefore takes handling of personal data seriously.

Abuse of personal data or not protecting them may lead to significant fines up to 4% of the company’s annual income or 20 million EURO.

First of all, GDPR is a strong regulation affecting every business and organisation dealing with personal data of anyone living in the EU.

Thus it also affects businesses operating outside the EU territory which, for some reason, process data of persons living in the EU.

GDPR could be divided into three main areas - security, personal data accessibility and legal.

This requires adding controls and, most probably, reorganisation of your data structure and storing process.

Security

GDPR requires personal data processors and controllers to protect this data against unauthorized disclosure.

If personal data is stolen or disclosed, and if investigation reveals that the organisation did not take enough effort to protect it, significant fine of up to 20 000 000 EURO could be given.

GDPR does not particularly contain a full list of controls.

Information protection is based on good practice and standards.

• Access control

Your organisation should possess systems that record and control every access to the data.

An installation of an appropriate Data loss prevention tool is strongly recommended.

A sufficient tool will fully control what data and in which way is extracted from your organisation.

Our company has extensive experience with DLP product implementation into diverse environments, helping to protect against various threats, including corporate spying.

• Monitoring

An appropriate control over the systems is recommended. All logs from the systems should be collected to some central place, assessed, correlated by SIEM and monitored 24/7.

• Reporting

Security incident when personal data are disclosed to unauthorised person must be reported to national authority within 48 hours.

For this purpose, our company is offering SOC as a service that save significant amount of budget compare to in house SOC.

• Vulnerability management

Abusing unpatched vulnerabilities are one of the easiest way to breach the environment and still data. It is recommended to regularly assess your environment for vulnerabilities. For this purpose, our company is offering our vScan solution that is easy to implement and cost friendly.

• Full information security standard

Above are mentioned minimum controls, but implementation of full information security standards is for big processors of private data inevitable.

4 steps how to achieve GDPR compliance

1. Accountability - Responsible person or DPO

Assigning one responsible, skilled and knowledgeable person for this task will make the GDPR compliance process much easier and smoother.

Our company can offer the service of one of our Information Security Consultants who operate as data protection officer as it is required by the GDPR.

DPO is responsible for evaluating and enforcing adequate GDPR processes.

DPOs must be appointed in the case of:

• public authorities,
• organizations that engage in large scale systematic monitoring, or
• organizations that engage in large scale processing of sensitive personal data.

2. Assessment – Data protection impact analyses (DPIA)

Each project dealing with private data is required to start with a DPIA. The DPIA is classification and assessment of private data,  compliance and risks from the legal, technical and security perspective.

Our company provides you with DPIA and with following solution proposal.

3. Design solution

After the assessment an appropriate solution should be designed.

To meet the GDPR requirements this solution should include legal adjustments, training, processes, technical solution and information security implementation.

Our company consultants have vast experience in designing solutions for large environment, including fortune 500 companies, and they are available to support or fully design your GDPR solution.

4. Implementation

The last step is the implementation of these designed legal, training, technical and information security controls.

These implemented solutions should be subject to a regular compliance audit in order to reveal and prevent any possible gaps.