On May 25, 2018, the European Union (EU) will begin to enforce a new data protection regulation called the General Data Protection Regulation (GDPR). The GDPR is designed to harmonize data privacy laws across Europe, to protect and empower all EU citizen’s data privacy and to reshape the way organizations across the region approach data privacy.

Who does the GDPR impact?

The GDPR applies to organizations located within the EU in addition to organizations located outside of the EU if they offer goods or services to, or monitor the behavior of, EU natural persons or - data subjects -. It applies to all companies processing and holding the personal data of data subjects residing in the EU, regardless of the company’s location.

What constitutes personal data as part of GDPR?

Any information related to a data subject that can be used to directly or indirectly identify the person, according to the GDPR. It can be anything from a name, a photo, an email address, bank details, posts on social networking websites, or medical information.

Are you ready for GDPR?

94% of US CIOs have data that is impacted
Only 60% of US respondents have plans in place to respond to the impact of GDPR
Only 19% of UK companies have such plans prepared
Source: Compuware, May 2017

Here are five steps that will help you on your journey to GDPR compliance

  1. Access. The first step toward GDPR compliance is to access all your data source. The regulation requires organizations to prove that they know where personal data is – and where it isn’t.
  2. Identify. Once you’ve got access to all the data sources, the next step is to inspect them to identify what personal data can be found in each. Often, personal data is buried in semistructured fields. You’ll need to be able to parse those fields to extract, categorize and catalog personal data elements such as names, email addresses and social security numbers. Considering the volumes of data at hand, this cataloging process can’t be manual. And you not only need to parse and classify personal data, you also have to accommodate varying levels of data quality. Things like patterns recognition, data quality rules and standardization are vital elements of this process. Having the right tools for the job will make a big difference in your ability to meet the May 2018 deadline for GDPR compliance.
  3. Govern. Getting a grasp on personal data starts with being able to define what personal data means and then share this understanding across your organization. For GDPR compliance, privacy rules must be documented and shared across all lines of business. This is the way to make sure personal data can only be accessed by those with proper rights, based on the nature of the personal data, the rights associated with users groups and the usage context. To achieve this, roles and definitions must be established in a governance model. Then you can link business terms to physical data sources, and establish data lineage from the point of creation to the point of consumption. This provides you with the required level of control.
  4. Protect. Once the personal data inventory and governance model are established, it’s time to set up the correct level of protection for the data. For GDPR compliance, you can use three techniques to protect data: encryption, pseudonymization and anonymization. You must apply the appropriate technique based on the user’s rights and the usage context without compromising your growing needs for analysis, forecasting, querying and reporting. The easiest way to protect data privacy is actually to press the delete button, keeping only the data you need to run critical business processes and added-value analysis
  5. Audit. The fifth step in your journey to GDPR compliance involves auditing. At this stage, you'll need to be able to produce reports to clearly show regulators that:
    • You know what personal data you have and where it’s located, across your data landscape.
    • You properly manage the process for getting consent from individuals who are involved.
    • You can prove how personal data is used, who uses it, and for what purpose.
    • You have the appropriate processes in place to manage things like the right to be forgotten, data breach notifications and more.