NC1801

OPINION
THE GDPR INFORMATION AUDIT
A GOOD UNDERSTANDING OF STORED DATA HAS ALWAYS BEEN A
SENSIBLE IDEA. AS COMPANIES MOVE FROM OWNERS OF DATA TO
CUSTODIANS, ROLAND BULLIVANT, DIRECTOR AT SILWOOD
TECHNOLOGY REMINDS US OF THE CRITICAL IMPORTANCE OF
THE DATA AUDIT
According to research undertaken
jointly by Experian and Ponemon
Institute - Data Protection Risks &
Regulations in the Global Economy - 59 per
cent of surveyed companies did not
understand the requirements for complying
with the EU General Data Protection
Regulations (GDPR). Because these
regulations become effective in May 2018,
the imperative for tested compliance
procedures and processes is pressing.
One important element requires
organisations to document the location of
what is defined in the GDPR as Personal
Data, across their entire IT estate. It is also
likely that organisations will need to make
amendments to existing IT systems to meet
the new obligations, especially concerning
how they process data, protect the rights of
data subjects and ensure appropriate
privacy, making certain that consent
measures are implemented.
It is here that the information audit
becomes pivotal for documenting personal
data and the interdependencies. It is
essential for implementing the policies and
procedures required for compliance.
One might think that successive waves of
hype driven IT such as Enterprise Resource
Planning (ERP), Customer Relationship
Management (CRM), Master Data, Data
Quality, Business Intelligence and Big Data
means that organisations are already firmly
in control of their data. The reality however is
that for the majority of organisations this just
isn't the case.
Some systems, particularly packaged
applications which store most of the
structured personal data held by an
organisation, actually contribute to the
difficulties associated with an organisations
ability to comply with the GDPR. This is due
to the complexity and inaccessibility of their
metadata. The result is that without specialist
software tools, isolating where personal data
exists about customers, business partners,
vendors, employees and members of the
public, is a long and tortuous task.
Personal data is also found across other
systems including online stores, mobile
apps, homegrown applications, data
warehouses and spreadsheets. It can also
be found in unstructured data formats
including email, documents, files,
photographs and others.
A Data Catalogue or Dictionary is
extremely valuable for keeping the source of
this information together and up to date.
Locating personal data is a vital step
towards meeting the requirements
concerning the rights of Data Subjects and
Consent and Privacy rules. For example, it is
not possible to give a comprehensive
answer to a Subject Access Request from a
customer unless all locations of personal
data are clearly understood.
For organisations still struggling to get
started, here are a few tips. Firstly, make sure
that you understand the relevant legislation
or identify trusted sources of information
about the GDPR to understand how it
applies to your organisation. You will need to
appoint an executive sponsor for your GDPR
program and a compliance team from
relevant departments, and don't forget to
secure a budget.
You will need to consider whether Data
Controllers and Data Protection Officers are
needed and appoint them. It is also
important to implement and document the
changes to your Data Privacy and Consent
policies, ensuring that processes are in place
to cover the Rights of Data Subjects.
Another important area is to make sure
that procedures are in place to detect data
breaches, with clear instructions on how to
notify the relevant authorities as well as
Data Subjects.
In summary, the GDPR means that
organisations will become custodians of the
personal data that they hold and process,
rather than the owners of that data. From
May 2018 they have greater responsibilities
concerning the way it is collected and used.
The negative impact of not complying can
be significant both financially and in terms of
damage to brand reputation. However there
are benefits, including improved customer
loyalty and revenues for those who master
the management of personal data effectively
and conscientiously. NC
32 NETWORKcomputing JANUARY/FEBRUARY 2018 @NCMagAndAwards
WWW.NETWORKCOMPUTING.CO.UK