EUROPEAN UNION'S GDPR CYBERSECURITY CHECK
EU's General Data Protection Regulation (2016/679) has be enforced since 25 May 2018 - Is your company ready? - Can you prove it?
Table of Contents
- Introduction
- Spending
- Background
- Goals
- Scope
- Definitions
- What GDPR Means for your organization / company
- GDPR getting started list
- GDPR in three bullets
- Safeguard your companies back & remove security threats
- Max fine €20M - Don't take any chances
- Zen-mode Solutions GDPR package
- How to proceed - Call us
- GDPR key changes
- Finland's Data Protection Authorities
- More information
- Pre GDPR fine examples
Introduction
Zen-mode Solutions offers it's cybersecurity knowhow to make sure that your company for-fills the GDPR requirements
Make GDPR be a business opportunity instead of a problem
It's a clear way of showing that your company knows what it is doing. Use it to increase your clients trust in your company. Add it to your homepage and slides and tell your clients about it:
We are a GDPR 2016/679 compliant company. Your data is safe with us. For more information please see our privacy page.
GDPR SPENDING
Over 80% expect GDPR Spending to be at least Six-Figures
Depending on which GDPR readiness studies your look at, between 40-80% of the IT professionals working at Medium to Fortune 500 sized companies expect GDPR-related spending to be anywhere between $100.000 - $10 million [ 1, 2, 3, 4 ].
Pick your GDPR consulting company carefully. Shortly put: (1) Big consulting companies: big bills; (2) Startups / SME's: lighter bills. Contact us and we'll give you a competitive offer!
Background
The General Data Protection Regulation (GDPR 2016/679) is a regulation created by European Commission which aims to unify data protection within the EU and to govern the export of personal data beyond EU’s boundaries.
GOALS
DATA PROTECTION BY DESIGN AND BY DEFAULT
One of the main goals of the GDPR regulation is to give the EU citizens / residents (data subjects) more control over their personal data and in doing so, increase their rights and freedoms. It harmonizes the data regulation across EU (and also Non-EU based companies doing business in the EU) which simplifies things, but at the cost of more strict data protection rules and sever penalties for breaking them.
Scope
ALL COMPANIES PROCESSING EU CITIZENS PERSONAL DATA
The regulation concerns any organization who is processing personal data of a EU citizen, regardless if the company who is doing the controlling / processing is EU-based on not. The same but put in another way: Any company that has a customer database of some-sort which contains personal data of a EU citizen.
Definitions
Definition of personal data [ * ]
Personal data is any information relating to an individual, whether it relates to his or her private, professional or public life. It can be anything from a name, a photo, an email address, bank details, your posts on social networking websites, your medical information, or your computer's IP address. The EU Charter of Fundamental Rights says that everyone has the right to personal data protection in all aspects of life: at home, at work, whilst shopping, when receiving medical treatment, at a police station or on the Internet.
Definition of controller [ 4(7) ]
A controller is the entity that determines the purposes, conditions and means of the processing of personal data.
Example 1: Company-A with a customer user database on their hard drive.
Example 2: Company-A which provides e-mail & work schedules to their workers.
‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data;
Definition of processor [ 4(8) ]
A processor is an entity which processes personal data on behalf of the controller.
Example 1: Cloud Company-B which rents virtual machines to Company-A.
Example 2: Cloud Company-B which provides e-mail & working schedules services to Company-A.
‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
What GDPR Means for your organization / company
Overview of GDPR actions
- Assign resources for your GDPR effort
- Requires (reoccurring) time & effort
- Not a one person job (board, legal etc)
- inhouse and/or out-source work? - A inventory of your personal data and the processing of it
- Personal data transparency
- What, Why, Who, Where - A inventory of your customers consent
- Can you demonstrate that you have it?
- Contracts may need to be renewed - Personal data & Cybersecurity check
- is your personal data safely stored & accessed?
- Data Privacy Impact Assessments
- Creation of DPIA, IRP, PD access logs etc
- These are the documents which should prove that you are GDPR compliant - Data protection by design and by default
- Should be inbuild / part of your normal software development & product development chain - Assigning a data protection officer (PDO)
- Mandatory for public authorities / big personal data processing organization - Be prepared for user requests
- are you able to easily export / update / delete your users personal data?
GDPR GETTING STARTED LIST
The new regulation will mean big changes for many companies. Your company might need to be a lot more careful when working with customers personal data than before. If your company has it's fingers all over the place, the GDPR effort might be quite painful at first.
Make sure that your companies cybersecurity is in order and that your customers personal data is safe & secure. Verify that all your solutions are using encryption and that the devices are running with the latest security patches. Double and tripple check that only the designated people have physical access to your systems containing personal data + log all access (when, what, why, who, where).
Create a complete map of your companies personal data usage (creation, update and deletion). Remember to include who is responsible / owns the different data sets and where & how it is stored. Remember how broad the definition of personal data is: you might have to re-arrange your databases etc to comply with the new regulation. Make sure your personal data is secure through it's whole life-cycle: initialization, update, deletion. Also remember to check that all of your backup systems comply with the tight rules.
Document everything related to the GDPR area. Your personal data inventory & map will come in handy here. Create a up-to-date DPIA and IRP documents. Remember to clearly document all work which touches your customers persona data (why, who, where, how) etc. In case of a breach / other problems, these documents & logs (when up-to-date and accurate) might prove more valuable than you think... (Article 35, Article 30)
Make sure that you have clear information about how your company is using your personal data and keep your promises. You do not need to renew your current customers consent, but any additional consents that you need, must be asked for + clearly marked as OK. Do not overstep your customers consent. Heavy fines await if you get caught doing things with your customers personal data without having permission to do it. Consent for children (data subjects below 16 years) must be given by the child’s parent or custodian (Article 7, Article 8).
Make sure that all of your employees understand and follow the GDPR regulation. Minimize the access to the personal data and write accurate logs of those who do access it and why. Remember that a single person (who might be breaking the GDPR rules badly...) can create huge problems even if you the worlds best cybersecurity in place...
Make sure you that can prove that you cybersecurity is in order and that you are on top of things. Train your employees for a cybersecurity breach, what actions should be done, what documents should be filed etc. In the case of a personal data breach you will have 72 hours to inform supervisory authority about the incident. You may also need to inform all affected users. Be prepared for this. Have the right procedures and documents in place and proceed accordingly to minimize the damage.
Be prepared for user requests related to their personal data: Right to rectification, Right to erasure - Right to be forgotten, Data Portability - Data migration. See GDPR KEY CHANGES for more details.
Depending on your business model it may or may not be mandatory for your company to have a designated Data Protection Officer (DPO, Article 37). To simplify and clarify things we recomend that all companies should have designated PDO (Company internal one-stop-shop mechanism related the personal data & privacy area). NOTE: before assuming the DPO role be sure to read the WARNING text regarding the possible legal risks.
All privacy switches which are present in the solutions that your company is selling should be set to high by default.
GDPR in
three bullets
