Almost a year after the General Personal Data Regulation - better known as GDPR - came into force, some organizations still struggle to get an overview of what is really needed to achieve full GDPR compliance. Therefore, we have compiled six simple steps you can follow in order to make it more tangible and clearer to draw up a GDPR action plan. So, keep reading, if you are tired of GDPR frustrations during the work day.
Map personal data and workflows in the organization
Firstly, it is important to identify and evaluate all data that exists within your organization. By doing this, you will create an overview of your personal data and the processes your organization uses in the data management. This makes it easier for you to compare your existing data protection conditions with the General Personal Data Regulation and identify any gaps in your efforts.
The GDPR process is a team process: Select the people involved
In order to gain an in-depth insight into all the data across the organization, you need to gather a team of process experts to handle the mapping process. Because, unless your organization is very small, it is unthinkable that one person has enough knowledge of all the organization’s processes to ensure 100% compliance. Therefore, the size of this team is governed by the size of the organization. In addition to the mapping and identification of gaps, the team will also assist with the implementation and ensure that all changes are in line with GDPR - which means that everything must be documented and written down. Because your efforts do not exist, if you are not documenting them - at least, if you ask The Danish Data Protection Agency. Therefore, it is very important to compile metadata of all your data management.
Appoint a Data Protection Officer
In addition to assembling a team, it is also important for the organization to appoint a specific person – aka. a Data Protection Officer (DPO) – whose main task is to advise, guide and monitor that the organization comply with the General Data Protection Regulation in every aspect. The DPO will not only be the link to the senior management, but also the Danish Data Protection Agency and will be responsible for the handling and development of the organization’s data position.
Data Protection: Use of software for GDPR
Another key factor in GDPR compliance is investment in software and external expertise. E.g., there are requirements for how an organization must encrypt and anonymize personal data. In addition, one must consider whether the method used to document one’s effort is good enough. For instance, Excel may have some shortcomings in relation to the documentation requirements set by the GDPR.
GDPR Compliance Culture: Create a Common Understanding of the Proces
In order to ensure that your compliance not only works in theory, but also in practice, it is essential that all employees are informed and aware of their responsibilities when it comes to data protection. An organization must provide good communication and training to create a good compliance culture where the focus is consistent across the organization. If every employee is not involved, it can be difficult for an organization to meet all the legal requirements.
Schedule regular updates
GDPR is not a stagnant process, but a dynamic approach to personal data protection. It is a never-ending story which an organization must continuously work on. In the future, there can occur changes to the legislation. It is important to be at the forefront of these by planning regular updates of policies and processes. Therefore, an organization must consider how best to handle changes like these, and how you want to inform the right people when an update must take place.
