The General Data Protection Regulation and GDPR Compliance Explained

The deadline for GDPR compliance is right around the corner; is your company ready? Here’s what you need to know about this important new data protection law and what your organization must do to prepare for it.

What is GDPR?

The General Data Protection Regulation, or GDPR, was adopted by the European Parliament in April 2016 as a replacement for an outdated data privacy directive that passed in the 1990s. The goal of the GDPR is to protect the personal data of EU citizens in the digital age. EU citizens will have numerous data privacy rights under the GDPR, including the right to prompt notification of a breach, the right to access their personal data, and the “right to be forgotten.”

What Constitutes “Personal Data” Under the GDPR?

Under the GDPR, “personal data” is a broad term encompassing “[a]ny information related to a natural person or ‘Data Subject’, that can be used to directly or indirectly identify the person.” This covers everything from an individual’s name and street address to their physical address to their health or biometric information. Even social media posts are considered “personal data.”

Who Must Comply With GDPR?

Although the GDPR is technically a European regulation, in reality, it applies internationally. In addition to applying to all companies with a presence in the EU, any company that sells goods and services to individuals or companies located in the EU or that “monitor[s] the behaviour of EU data subjects” must comply with the GDPR, regardless of where the company is located.

This means that GDPR compliance applies to nearly all large businesses, as well as many small and medium-sized businesses; if you have even one customer located in the EU, you must comply.

When is the GDPR Compliance Deadline?

Organizations must comply with the GDPR by May 25, 2018.

How Will Brexit Impact GDPR Compliance? What If I Only Sell to UK Customers?

Companies that are located in the UK or that sell to UK customers should still prepare to comply with GDPR. The UK is not scheduled to leave the EU until March 29, 2019, 10 months after the GDPR compliance deadline. Further, the British government has stated that it intends to pass its own data protection bill that will be at least as stringent as the GDPR, if not more so.

What Constitutes GDPR Compliance?

At its core, the GDPR is about data governance. Organizations will need to change the way in which they process, store, and protect customers’ personal data, keeping in mind the various data privacy rights outlined in the GDPR. Similar to HIPAA, the GDPR does not outline specific technical controls but instead tells organizations what they need to achieve; it’s up to them to figure out how.

One of the biggest changes is the GDPR breach notification requirement; companies must notify the authorities and affected customers within 72 hours of detecting a breach. This requirement is meant to prevent scenarios like the Uber hack, where the company not only waited a year to notify its customers but actually tried to cover the incident up.

The GDPR also addresses the growing problem with third-party vendor breaches. Organizations that hire third-party vendors who will be handling the personal data of their EU customers will have to ensure that their contracts with those vendors comply with the GDPR.

Additionally, some organizations will have to appoint a Data Protection Officer (DPO) to oversee GDPR compliance and overall data security. This requirement applies to organizations that are public authorities, “engage in large scale systematic monitoring,” or “engage in large scale processing of sensitive personal data.”

What Are the Penalties for Non-Compliance?

Depending on the severity of the infraction, organizations can be fined up to 4% of their annual global turnover, or 20 million euros (approximately USD $24 million).

How Can I Get Ready for GDPR Compliance?

The best way to prepare for the GDPR is to enlist help from an experienced IT audit and compliance firm like the GRC experts at Lazarus Alliance. The full text of the GDPR is 88 pages long, and what “compliance” means for your organization depends on your individual data environment, cyber ecosystem, risks, and vulnerabilities. For example, the GDPR specifies that companies must provide “reasonable” levels of data privacy and protection to EU customers, but what is considered “reasonable” is left open for debate – and you don’t want to end up on the losing side of that one!

While many organizations are dreading GDPR compliance, in the end, it will be a net positive for everyone. The GDPR will force companies to closely examine their data governance policies and controls and enact proactive cyber security measures to prevent breaches.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.

Compliance automation software is the answer to rising compliance costs

After last year’s U.S. presidential election, many businesses eagerly awaited a new “era of deregulation” that would allegedly result in relaxed compliance requirements – and lower costs. Although some regulations have been relaxed or even repealed, IT compliance is as time-consuming and expensive as ever. A recent survey by Wealth Management found that broker/dealers and registered investment advisors have increased their compliance budgets by an average of 9%. Further, investment advisors charged with compliance oversight report that compliance tasks take up 1/3 of their time. So much for the “era of deregulation.” Fortunately, the era of compliance automation is upon us.

In the Beginning, There Was Excel

For many years, organizations and third-party IT auditors have been using Microsoft Excel to “automate” their IT compliance processes. This worked well – in the 1990s, when the only other option was paper files. If your organization, or your IT auditor, is still using Excel for “compliance automation” in 2017, you aren’t actually “automating” anything. Excel is a great spreadsheet program, but it is not an IT audit and compliance solution, nor will it do anything to help you with IT governance and risk management, which are integral parts of compliance.

Modern RegTech software solutions, such as Continuum GRC’s IT Audit Machine (ITAM), are designed specifically to create, measure, monitor, and manage IT governance programs for compliance frameworks such as COBIT, FedRAMP, COSO, SSAE 18 SOC 1, AT 101 SOC 2, CJIS, DFARS, ISO 27001, ISO 27002, ISO 27005, NIST, and ITIL. With compliance automation software, your organization gets a truly automated, workflow-driven approach to managing, communicating, and implementing IT policies and procedures.

Let’s look at some of the ways in which compliance automation software saves time, money, and headaches.

How IT Compliance Automation Software Helps You Work Smarter, Not Harder

It helps you bridge the cyber security skills gap. The cyber security skills gap is quite real, and it’s getting worse by the day. Qualified cyber security personnel are difficult to find, and even if your company manages to snag one, it will pay top dollar for them. Compliance automation software fills this void by getting you the expert compliance help you need right now, at a price that’s far lower than what you’d pay to hire internal staff or even outsource the work to an IT audit firm. On average, ITAM users see a 46% reduction in labor costs.

It frees up your internal IT resources. Information technology personnel don’t grow on trees, either. By automating your IT compliance processes, your internal IT staff have time to work on initiatives that will grow your business instead of being bogged down with compliance audits.

It enables rapid report generation. Compliance automation software lets you say good-bye and good riddance to fumbling around and trying to reconcile a dozen different spreadsheets. Easy-to-use self-help modules and a centralized repository of all IT compliance requirements, with their associated controls and automated information flows, let you generate complex reports with just a few clicks of your mouse. On average, ITAM users speed up report generation by 180%!

It ensures that your controls are up-to-date. Compliance standards are continually evolving. Excel can’t tell you if your controls are compliant with the latest changes to IT security frameworks, but compliance automation software like ITAM can. If the regulations change, you find out right away, and you can respond right away.

It eliminates silos and improves cyber security. Respondents to the Wealth Management survey named cyber security as the top priority of their compliance efforts. Compliance automation software like ITAM doesn’t just make compliance easier; it integrates IT governance, policy management, risk management, compliance management, audit management, and incident management. With one user portal, you get the big picture of your organization’s cyber security controls, risks, and vulnerabilities.

What You Need to Know About GDPR Compliance