Few have conducted any form of gap analysis and have no idea where they are now and the steps that they will need to take to be compliant \u00a0with GDPR in just over a year\u2019s time. The evidence to suggest that they haven\u2019t looked properly at the problem is that they\u2019re always far too relaxed about their ignorance.<\/p>\n
The GDPR isn\u2019t\u00a0a cyber security law: it\u2019s a data protection law. It\u2019s a \u2018Business Risk\u2019 issue. It belongs in the Boardroom. The UK data regulation agency, namely the Information Commissioner\u2019s Office, has already stated that it will hold directors personally responsible for breaches under their watch. The Information Commissioner is on record as saying that directors should be prosecuted where they fail in their supervision. Under the GDPR, individuals must be trained and managed properly. Processes must be in place to ensure that this is done. Governance is a Board responsibility. It has nothing to do with the IT Department.<\/p>\n
The only mention that technology receives in the GDPR is a reference to the fact that technology in place must be \u2018state-of-the-art\u2019 (whatever that moving feast might mean). The GDPR is, first and foremost, about people, process and governance. It\u2019s about how companies go about collecting their data, how they process it and how they look after it, not about the tools they use to do all of that.<\/p>\n
It\u2019s not about expensive and complex software. We\u2019ve found that, in some circumstances, such software may make it impossible for a business to comply with the law. That\u2019ll be quite a lot of cash thrown straight\u00a0into the bin, then!<\/p>\n
Clearly, software is an important part of data protection, but it\u2019s there to support the process. Unless the people and process issues are attended to, non-compliance and\/or a breach is almost certain to be the result. The great majority of breaches have their genesis inside an organisation, usually because someone makes a mistake or does something malicious \u2013 both matters which should be prevented through effective governance and both matters which the regulators are likely to lay on the company.<\/p>\n
Essentially, in order to comply with the GDPR every company must know exactly what data they have, where it is, what they are doing with it and, crucially, make sure that they have the consent of the data subject (or other legal reason) to be doing it. Let\u2019s face it, if you don\u2019t know what you have \u2013 and most companies could not say exactly what personal data they hold \u2013 you don\u2019t\u00a0have a hope of complying with the other elements.<\/p>\n
This means that you will not\u00a0\u2013 we could argue cannot\u00a0\u2013 have the consent of the data subject to be doing it. Just to add spice to the challenge, organised paperwork (HR, client files, etc) falls under this law. Failure to comply with the consent aspects of the GDPR can run into\u00a0a 4% of turnover (or \u20ac20 million, whichever is the greater) fine.<\/p>\n
Consent must be freely and knowingly given, cannot be open-ended and must be for a specific purpose. No catch-all, no pre-ticked boxes, no gobbledygook. In some cases, consent must be specific. Sensitive data and children\u2019s data must be handled with additional protections. Minimisation is the general principle here.<\/p>\n
If, on 25 May next year, you do not comply with this law, then \u2013 as stated \u2013 you run the risk of being fined up to 4% of group global turnover, not for being breached, but just for not being compliant. The Information Commissioner is in the process of hiring an investigation force now whose job will be to check that companies are compliant.<\/p>\n
If you have a realistic plan and you\u2019re actively working towards implementing it, the Information Commissioner\u2019s investigators will likely look favourably upon you. If you have been tardy, lazy or, worsen still, wilfully decide to ignore the requirements of this law, the chances are that the outcome for companies and individual executives involved in the decision-making chain will be decidedly sub-optimal.<\/p>\n
Make sure a gap analysis is carried out. Make a plan. Start moving now. Time is already short.<\/p>\n