{"id":1728,"date":"2024-03-09T10:06:47","date_gmt":"2024-03-09T10:06:47","guid":{"rendered":"http:\/\/151.252.3.34\/~tenintel\/?page_id=1728"},"modified":"2024-03-14T00:34:10","modified_gmt":"2024-03-14T00:34:10","slug":"gdpr-journey-far","status":"publish","type":"post","link":"https:\/\/tenintel.com\/gdpr-journey-far\/","title":{"rendered":"GDPR: Our Journey So Far"},"content":{"rendered":"

[vc_row full_width=”stretch_row”][vc_column]\n\n\n

\n GDPR: Our Journey So Far <\/h2>\n\n\n\n [vc_empty_space height=”10px”]\n\n
\n

Our journey in data protection began in February 2017 with our adoption of the ISO 27001 framework for Information Security Management. This step underscored our commitment to upholding robust data protection standards globally.<\/span>\u00a0<\/span><\/p>\n

As providers of comprehensive data protection services on a global scale, we not only ensure our own compliance with GDPR but also assist our clients in adhering to various international data protection laws and regulations like EUGDPR, PLPL, CCPA, and CPRA.<\/span>\u00a0<\/span><\/p>\n

Specialising in Data Protection Officer (DPO) services across diverse sectors worldwide, we emphasise our dedication to safeguarding both personal data and sensitive information.\u00a0<\/span>\u00a0<\/span><\/p>\n

Throughout our journey, we’ve recognised the importance of effectively communicating the significance of data protection from senior management to every team member. This understanding is crucial for our business’s success and reputation.<\/span>\u00a0<\/span><\/p>\n

We remain vigilant about the potential impact of existing and upcoming Data Protection Laws & Regulations, such as GDPR, on both our operations and our clients. Hence, we consistently strive to convey this message promptly and reinforce our internal culture of data security to ensure ongoing compliance.\u00a0\u00a0<\/span>\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

Mapping your data<\/span><\/b>\u00a0<\/span><\/b>\u00a0<\/span><\/h2>\n

Unless importance and resource are applied to how your organisation complies to Data Protection Laws such as GDPR, prepare to face the risk of the financial and reputational impact that organisations face due to noncompliance of Data Protection Law and Regulations.<\/span>\u00a0<\/span><\/p>\n

Take some time out with a DPO specialist, whilst having no distractions and list where you think data is stored. This will help form part of your data mapping.\u00a0<\/span>\u00a0<\/span><\/p>\n

Keep it simple to start with, consider: <\/span>Key aspects of data management and protection, including how personal data is obtained (e.g., through emails, websites, CCTV), types of data collected (e.g., name, date of birth, banking details), storage locations (e.g., PCs, cloud-based systems), access control, and sharing outside of your jurisdiction. It also covers organizational details, purpose of data processing (e.g., compliance with legal requirements), data recipients, and measures to safeguard data privacy during transfers.\u00a0<\/span>\u00a0<\/span><\/p>\n

Additionally, this will addresses retention schedules, security measures, privacy notice information, consent records, and controller-processor contracts. Examples include maintaining records of individuals’ consent for data processing and conducting assessments to identify and mitigate risks associated with data processing activities.<\/span>\u00a0<\/span><\/p>\n

There are several ways of mapping this phase. We used a product called i2 Analyst Notebook<\/a> to help map our data or \u201cinformation flow\u201d; but you can use a simple flowchart within Word, or even a large flipchart or board. This will bring your data mapping to life, and you will be able to see and add to your map as the process continues.<\/span>\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

Questioning<\/span><\/b>\u00a0<\/span><\/h2>\n

Data Protection Assessment is a vital tool for organizations to ensure compliance with Data Protection laws and regulations. By examining various aspects of the business, such as roles and responsibilities, communication, training, internal audit procedures, marketing activities, data flow, breaches, and subject access request handling, organizations can identify gaps and take necessary actions to address them. This assessment involves asking a series of questions to determine the current state of compliance and what steps need to be taken.<\/span>\u00a0<\/span><\/p>\n

The process involves reviewing policies, procedures, internal communications, incident logs, and other relevant documents to gather evidence of compliance with Data Protection laws. Once completed, the assessment informs the development of a Data Protection Action Plan. This plan outlines specific actions, sets timelines, allocates responsibilities, and establishes monitoring measures.<\/span>\u00a0<\/span><\/p>\n

As is with our internal process, regular reassessment through gap analysis is essential to ensure ongoing compliance. Conducting assessments once or twice a year allows organizations to adapt to changes in regulations and business practices, ensuring that Data Protection remains a priority within the organization. Ultimately, this proactive approach helps mitigate risks, protects individuals’ privacy rights, and builds trust with customers and stakeholders. <\/span>If you\u2019re interested, we can share our assessment questionnaire tool with you.\u00a0<\/span>\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

Internal process changes<\/span><\/b>\u00a0<\/span><\/h2>\n

You have a responsibility under the GDPR to update and review your internal policies and procedures. The aim is ensure they reflect your compliance to the GDPR and communicate these to your employees and third parties. Don\u2019t assume that everyone will comply with your request, talk with them too. Make it part of your organisation\u2019s plan to implement regular Data Protection Training and Privacy Impact Assessments.<\/span>\u00a0<\/span><\/p>\n

Decisions like how long to retain personal information should be set; who has access to the information (and who does not need access); keeping a record\/register of the consents you have; and reviewing your ongoing relationships with individuals and their data.<\/span>\u00a0<\/span><\/p>\n

Consider also the procedures you will follow if you ever have the misfortune to detect or report a breach. Does your organisation require a dedicated Data Protection Officer (DPO) or someone else to take responsibility for data protection compliance? Who and where do you report a breach to? Do you outsource your data protection compliance?\u00a0<\/span>\u00a0<\/span><\/p>\n

Ensure you have a procedure to follow when receiving a Subject Access Request. For instance:<\/span><\/p>\n