C&L_December 2017 (1)

Cover Story
tination,” - according to a white paper titled GDPR and India,
written by Aditi Chaturvedi for The Centre for Internet and
Society.
Capgemini Sogeti India, a fully-owned subsidiary of the
Capgemini Group, with total revenues of EURO 6,412 million
this year, is a well-known French IT Services and Consulting
Organization and has customer across Europe and USA.
According to Harshad Mengle, Director – Cyber Security at
Capgemini Sogeti, we have taken a structured approach and
the framework is in place to address GDPR needs.”
“It is important to disclose how we are going to protect our
customer’s data, and this in turn, will give more confidence
to our EU customers. Some of the challenges include how we
will alter our entire ecosystem in order to incorporate data
management protection as per GDPR guidelines, how the
“We have been running
a global project for
GDPR compliance
across the company
and are tracking actions
across subsidiaries and
shared services. Being
an EU headquartered
company, we need to
comply with all the
requirements of GDPR.”
Parag Deodhar
Information Security Leader at a
reputed financial services firm
workflow systems need to be changed, and how IT and monitoring
systems need to be aligned with privacy data in order
to be compliant,” said Mengle.
“A good compliance- to- privacy framework will help
C-suite build strong technological and process control framework
which can be also easily integrated with security operation
management for privacy breaches,” he added.
The IT Services player has already employed a data controller,
data processor, and a data protection officer who will take
up responsibility of ensuring compliance.
Evalueserve Inc, a knowledge services provider, with estimated
annual revenues of more than USD 250 million offers
research, analytics, and data management services to Fortune
500 companies in the United States and internationally. The
company has both clients and employees working from EU
and their personally identifiable data will come under the
purview of GDPR.
According to Evalueserve’s Chief Information Officer and
Chief Information Security Officer, Sachin Jain, we comply
with UK/EU data protection act for some of our clients – so it
is not going to be a difficult change for us.
“However, the team involved has started working on it proactively
to be ready to show compliance to GDPR well ahead
of the deadline,” he added.
The GDPR also levies steep penalties of up to EUR 20 million
or 4 % of global annual turnover, whichever is higher, for
non-compliance. The language in the guideline uses the word
“reasonable” to indicate the level of data protection and privacy
that companies should observe towards EU citizens.
Immediate next steps to tackle GDPR
1. Demanding new privacy rights and obligations Educate key
stakeholders, including the board of directors Risk-assess
(including legal applicability) whether the GDPR applies to
your organization
2. Establish cross-function and cross-business governance
structure for assessment of the GDPR’s applicability to
business operations, evaluation of readiness and management
of your overall GDPR remediation efforts
3. Conduct a privacy impact assessment, with a strong focus
on high-risk data flows of business processes
4. Conduct a GDPR gap assessment, with a particular focus
on governance, policies, technology, external dependencies
(e.g., vendors), existing data flows ("high-risk") and
processing operations
5. Design and execute a prioritized implementation plan to
address gaps based upon risk tolerance, risk priority,
resourcing and investment
Source: EY report titled ‘GDPR: demanding new privacy rights and obligations’
12 CIO&LEADER | December 2017