The European Union’s study conducted by IAPP in late 2017, thousands of businesses, including many small-to-medium-sized enterprises, are still struggling to digest dozens of provisions of legislative text. Importantly, GDPR compliance is not a discrete point-in-time challenge, but rather an ongoing process that will occupy data professionals in companies all over the world, for many years to come.
Top 10 operational GDPR responses
There is much to do to build programs compliant with what is undoubtedly history’s most comprehensive data protection law. With 99 Articles and more than 170 Recitals, the GDPR challenges even the most experienced data protection and privacy professionals with its sheer size, scope and complexity. Indeed, the top barrier to GDPR compliance according to the IAPP’s 2017 study is “complexity of the law.”
Giving up isn’t an option, of course, so here is the list of the top 10 operational responses identified by our experts as the best plan of attack:
1) Conduct data inventory and mapping. This is where you start and is accordingly the subject of this first post.
2) Establish a lawful basis for data processing and cross-border transfers.
3) Build and maintain a data governance system, including establishing leadership (where appropriate, a data protection officer, setting forth policies and training personnel.)
4) Perform data protection impact assessments, along with data protection by design and by default.
5) Prepare and implement data retention and record keeping policies and systems.
6) Meet information transparency and communications obligations.
7) Configure systems and put in place processes to accommodate data subjects’ rights, including access, rectification, erasure, portability, objection to automated processing and revocation of consent.
8) Prepare for security breach response and notification.
9) Have a sound vendor management (processor) protocol.
10) Establish systems and channels for communicating with your data protection authority.
Data inventory and mapping
One can search the GDPR in vain for the terms “data inventory” or “mapping.” They are simply not obliged by the plain language of the law.
But unquestionably, the first operational response to GDPR, essential to building a program that aims to comply with the law, is a comprehensive exercise of data mapping and inventory. The terms may have slightly different meanings depending on whom you ask, but they involve at least the following:
- Understanding the definition of personal data under the GDPR.
- Determining what personal data is collected and used (“processed” in GDPR-speak) by the organization.
- Finding out where the data is stored, including what third-party systems might house it and where, geographically, the servers are located.
- Mapping where the data goes from point of collection throughout the organization and externally to vendors or other third parties.
- Determining how long the data is retained and in what formats. This includes having a sense of whether the data are “structured” (in relational databases) or “unstructured” (everything else, such as loosely organized systems, including paper files or PDFs, for example).
Without conducting the inventory and mapping exercise, a data protection professional cannot meaningfully build out a program that meets the GDPR’s many obligations, including establishing a lawful basis for processing, providing data subjects with transparency and meeting their other data protection rights, knowing when and how to gather and record consent, and the like. It is quite difficult, for example, to prepare a privacy statement or an internal privacy policy without understanding what data is collected, how it is processed, and with whom it is shared.
Importantly, data inventory is also the first step in complying with obligations to keep records of processing under Article 30. This pivotal provision of GDPR requires companies to maintain detailed records of their processing activities, including the purposes of the processing; a description of the categories of data subjects and of personal data; any recipients with whom personal data are shared, including their geographic location; any cross border data transfers and risk mitigation measures; data retention schedules; data security policies; contact details of a European representative and DPO, where applicable; and more.
Tools and methods
The best method to conduct data inventory and mapping will depend on an organization’s size and complexity, as well as the amount of time allotted to the exercise and the sophistication of the participants.
Many data protection and privacy professionals, perhaps assisted by outside counsel or consultants, begin with a questionnaire. Those with adequate time can engage in an initial discovery exercise to unearth their organization’s general personal data life cycles, followed by deeper-dive questionnaires and follow-up interviews, and even workshops.
Ideally, the inventory and processes created to support it allow – eventually, at least – the capacity to identify data location and storage information at the level of an individual data subject: What data do I have on Jane Doe, and where is it located? If Jane wants access to her data, how can I be sure to find it all for her?
Assigning a level of risk to distinct data categories is also important at this stage. After all, the GDPR fundamentally takes a Article 9? This would require a company to rely on a different legal basis than for regular processing. Would unauthorized access to data create high risks to the rights and freedoms of the data subjects? This would trigger a DPIA or require an individual breach notification.
For many, this information is currently tracked in home grown and adapted tools available through standard enterprise software products. In the IAPP-EY 2017 Governance Report, 45 percent of respondents reported they conduct data inventory and mapping informally, using manual and informal processes including email, interviews and spreadsheets; only 32 percent reported using commercial products developed exclusively for data inventory and mapping.
Over the past few years, a privacy technology industry has exploded in response to the GDPR and other privacy regulatory developments. Dozens of startups have emerged to provide solutions and tools for organizations working on data protection regulatory compliance, accountability, and risk mitigation, as highlighted in the IAPP’s annual Article 5 of the GDPR requires that personal data be processed “lawfully and fairly” and “collected for a specified, explicit and legitimate purpose.” Assigning such a basis at the inventory stage expedites compliance with GDPR’s core obligations.
Indeed, record keeping under Article 30 is often conflated with inventory and mapping, and although there is no reason they cannot overlap operationally they are not necessarily the same thing. Article 30 does not expressly require the record to demonstrate lawful basis for processing, and yet that is a core GDPR requirement. Best practices counsel in favor of assigning these bases and recording them at the inventory stage.
The next installment in this series will address the various lawful bases under Article 6 and how operationally to select – and appreciate the consequences of – lawful bases options.
Conclusion
Preparing for GDPR compliance requires starting with an inventory of the organization’s personal data processing practices, from collection and use, to storage, retention and deletion. While some technical solutions are being offered to help with this process, many practitioners are finding that self-service is still the norm. As long as this is the case, this process will for many organizations be labor intensive and perhaps more time consuming than ideal, especially given the looming May 25, 2018, GDPR-implementation deadline. Nonetheless, a careful inventory of personal data processing practices is a crucial first step in the operational response to the GDPR.
photo credit: Sieboldianus Animated Map of geotagged Flickr photos (Europe), 2007-2017 via photopin