A lot of companies across the globe have the EU General Data Protection Regulation (GDPR) in their insights. They are aware of the fact that no matter where they are, the GDPR impacts them when they are supplying products or services to EU citizens or organisations. Non-compliance to the regulation can lead to serious damage to the business.
Personal data has significant value. When properly managed, it can create a substantial competitive edge. The new regulation provides all EUR citizens with the right to know and decide how their personal data is being used, protected, stored, deleted, and transferred. For companies, this means the implementation of the GDPR will impact their entire organisation. They have to determine how to handle personal data from the source to the point of consumption. To take the right approach to GDPR compliance, here are the steps to take:
Accessing All Data Sources
Regardless of the technology a company uses for data management, they should investigate and audit what data is being stored and used across their data landscape. They need to have seamless access to all data sources so they can build an inventory of personal data. This will let them assess their privacy risk exposure and enforce business-wide privacy rules. To ensure they comply with the GDPR, the must be able to prove that they know where data is and where it isn’t.
Identifying Data that Can Be Found in Every Source
Usually, personal data is kept in semi structured fields. Such fields should be parsed to make data extraction, categorisation, and cataloguing data elements possible. With the volume of data at hand, the cataloguing process cannot be done manually. And aside from parsing and classifying personal data, it is important to accommodate different levels of data quality. In this process, things such as data quality rules, patterns recognition, and standardisation are important.
Sharing Information Across the Organisation
To comply with the GDPR, privacy rules need to be documented and shared across every line of business. This ensures personal data can only be accessed by individuals with the proper rights, based on the data’s nature, the usage context, and the rights associated with users groups. This can be achieved by establishing roles and definitions in a government model, linking business terms to physical data sources, and establishing data lineage.
Auditing
The audit report must clearly shows regulators a company’s knowledge of the personal data they have and its location and its ability to manage the process for getting consent from people involved. It is also important to prove the way the data is used, the people who use it, and for what purpose.
