The GDPR has set fairly broad goals and requirements for businesses and organisations, making it quite hard to know exactly what they have to do to become, and remain, compliant, and whose job it is. Until the rules become more prescriptive, it falls on each business or organisation to work out what will be an acceptable effort towards becoming compliant with the regulation. As for whose job it is, experts say the responsibility and accountability lies with every member of a company, from the board of directors down. That said, someone needs to drive the process and to see that the rest of the team receives training in GDPR best practices. But that’s a topic for another post.
Meeting requirementsImagine you own a small to mid-sized business, have read up online about the GDPR and signed up for news feeds about it. You’ve also worked out what you need to do to refine your particular information systems so that you meet GDPR compliance requirements in terms of how you collect, use, store and possibly share personal data. You haven’t used compliance software but you know the proof of your compliance efforts are there somewhere between your laptop, a colleague’s laptop, a few flash drives and the cloud.
Showing complianceWhat would you do if the authorities asked to see your compliance efforts? Would you be able to produce an understandable data map of where and how personal information flows through your business? Will your privacy notice 100% up to date? How long would it take for you to generate a status report on your GDPR compliance? For many businesses, being able to prove GDPR compliance would be a matter of stopping ops and pulling it all together – in a panic. The regulation is a reality and isn’t going away, so it’s probably wise to get your business to a point where you can produce a data map in a day, have a system to ensure that your privacy notice is always current, and that you can generate a status report within a couple of days.
Compliance softwareIt would be easier if you used compliance software. For a monthly fee of between €50 per month (up to 9 employees) and €100 per month (up to 50 employees) you would have all your compliance efforts available within a few hours. These are the kinds of things you’d be able to show straight away:
- A current report on your GDPR compliance status This can be generated in one-click and shows your compliance readiness to date.
- An up-to-date privacy notice When you make changes to your privacy notice it’s automatically updated and republished to your website, keeping you in line with GDPR governance requirements.
- The status of all subject access requests The software keeps a record of when the SAR was submitted, when the request was actioned and what the status of the request is.
- An outline of personal information processing that occurs in your business The software contains a data mapping tool that enables you to show where and how personal information flows through your business.
- All relevant documentation indicating steps you’ve taken towards compliance Every step of your compliance journey taken with the software is recorded so that you can produce an electronic paper trail at any time.
- The status of data breach incidents The software enables you to manage data breaches, from assessing and documenting to reporting them within the stipulated 72 hours of becoming aware.
- The status of each employee’s training in GDPR best practices The training programme within the software logs each employee’s progress.