GDPR compliance checklist – IBM Blog

The Normal Knowledge Safety Regulation (GDPR) is a European Union (EU) legislation that governs how organizations accumulate and use private knowledge. Any firm working within the EU or dealing with EU residents’ knowledge should adhere to GDPR necessities.

Nevertheless, GDPR compliance just isn’t essentially an easy matter. The legislation outlines a set of information privateness rights for customers and a collection of ideas for the processing of non-public knowledge. Organizations should uphold these rights and ideas, however the GDPR leaves some room for every firm to determine how.

The stakes are excessive, and the GDPR imposes important penalties for non-compliance. Essentially the most severe violations can result in fines of as much as EUR 20,000,000 or 4% of the group’s worldwide international turnover within the earlier 12 months. GDPR regulators may terminate illicit knowledge processing actions and compel organizations to make adjustments.

The guidelines under covers the core GDPR rules. How a corporation meets these rules will rely upon its distinctive circumstances, together with the sorts of information it collects and the way it makes use of that knowledge.

GDPR fundamentals

The GDPR applies to any group based mostly within the European Financial Space (EEA). The EEA consists of all 27 EU member states plus Iceland, Liechtenstein and Norway.

The GDPR additionally applies to organizations exterior of the EEA if:

The corporate frequently provides items or providers to EEA residents, even when no cash is exchanged.

The corporate frequently screens the exercise of EEA residents, akin to by utilizing monitoring cookies.

The corporate processes knowledge on behalf of an organization based mostly within the EEA.

The GDPR doesn’t solely apply to companies utilizing buyer knowledge for business functions. It applies to almost any group that processes EEA residents’ knowledge for any function. Colleges, hospitals and authorities companies all fall underneath GDPR authority.

The one knowledge processing actions exempt from the GDPR are nationwide safety or legislation enforcement actions and purely private makes use of of information.

Helpful definitions

The GDPR makes use of some particular terminology. To know compliance necessities, organizations should perceive what these phrases imply on this context.

The GDPR defines private knowledge as any data regarding an identifiable human being. The whole lot from electronic mail addresses to political views counts as private knowledge.

An information topic is the human being who owns the info. Put one other manner, it’s the individual the info pertains to. Say an organization collects cellphone numbers to ship advertising and marketing messages through SMS. The homeowners of these cellphone numbers can be knowledge topics.

When the GDPR refers to knowledge topics, it means knowledge topics who reside within the EEA. Topics needn’t be EU residents to have knowledge privateness rights underneath the GDPR. They merely should be EEA residents.

An information controller is any group, group or person who obtains private knowledge and determines how it’s used. Returning to a earlier instance, an organization amassing cellphone numbers for advertising and marketing functions can be a controller. 

Knowledge processing is any motion executed to knowledge, together with amassing, storing or analyzing it. An information processor is any group or actor that performs such actions.

An organization may be each a controller and a processor, like an organization that each collects cellphone numbers and makes use of them to ship advertising and marketing messages. Processors additionally embody third events that course of knowledge on behalf of controllers, like a cloud storage service that hosts a cellphone quantity database for one more enterprise.

Supervisory authorities are the regulatory our bodies that implement GDPR necessities. Every EEA nation has its personal supervisory authority.

Discover knowledge safety and safety options

The GDPR compliance guidelines

At a excessive stage, a corporation is GDPR compliant if it:

Adheres to the info processing ideas

Upholds the rights of information topics

Applies acceptable knowledge safety measures

Follows the foundations for knowledge transfers and knowledge sharing

The next guidelines breaks these necessities down additional. The sensible steps a corporation takes to fulfill these necessities will rely upon its location, sources and knowledge processing actions, amongst different components.

Knowledge processing ideas

The GDPR creates a set of ideas organizations should observe when processing private knowledge. The ideas are as follows.

The group has a lawful foundation for processing knowledge.

The GDPR defines the circumstances underneath which corporations can legally course of private knowledge. A company should set up and doc its authorized foundation earlier than amassing any knowledge. The group should talk this foundation to customers on the level of information assortment. It can not change the premise after the very fact except it has consumer consent to take action.

The potential lawful bases embody:

The group has the topic’s consent to course of their knowledge. Notice that consumer consent is barely legitimate whether it is knowledgeable, affirmative and freely given.

Knowledgeable consent means the corporate clearly explains what knowledge it’s amassing and the way it will use that knowledge.

Affirmative consent means the consumer should take some intentional motion to indicate consent, akin to by signing a press release or checking a field. Consent can’t be the default choice.

Freely given consent means the corporate doesn’t try to affect or coerce the info topic. The topic should be capable of withdraw their consent at any time.

The group has a authorized obligation to course of the info.

The group should course of the info to guard the lifetime of the info topic or one other individual.

The group is processing knowledge for causes of the general public curiosity, akin to journalism or public well being.

The group is a public authority processing knowledge to carry out an official operate.

The group is processing the info to pursue a reliable curiosity.

A reliable curiosity is a profit the controller or one other get together may acquire by processing the info. Examples embody conducting background checks on workers or monitoring IP addresses on a company community for cybersecurity functions. To assert a reliable curiosity foundation, the group should show that the processing is important and doesn’t infringe on topics’ rights. 

The group collects knowledge for a selected function and solely makes use of it for that function.

In response to the GDPR precept of function limitation, controllers should have an recognized and documented function for amassing knowledge. The controller should talk this function to customers on the level of assortment, and it could solely use the info for this named function.

The group solely collects the minimal quantity of information crucial.

Controllers can solely accumulate the minimal quantity of information crucial to meet their said function.

The group retains knowledge correct and updated.

Controllers should take affordable steps to make sure the non-public knowledge they maintain is correct and present. 

The group deletes knowledge when it’s not wanted.

The GDPR requires strict knowledge retention and deletion insurance policies. Firms can solely maintain knowledge till the required function for amassing that knowledge has been fulfilled, they usually should delete the info as soon as they not want it.

The group takes further precautions when processing kids’s knowledge or particular class knowledge.

Controllers and processors should apply extra protections to sure kinds of private knowledge.

Particular class knowledge consists of extremely delicate knowledge like an individual’s race and biometrics. Organizations can solely course of particular class knowledge in very restricted circumstances, akin to to forestall severe public well being threats. Firms may course of particular class knowledge with the topic’s express consent.

Felony conviction knowledge can solely be managed by public authorities. Processors can solely course of this data at a public authority’s course.

Controllers should receive a mother or father’s consent earlier than processing kids’s knowledge. They need to take affordable steps to confirm the ages of topics and the identities of fogeys. If amassing knowledge from kids, controllers should current privateness notices in child-friendly language.

Every EEA state units its personal definition of “youngster” underneath the GDPR. These vary from “anybody underneath the age of 13” to “anybody underneath the age of 16.” 

The group paperwork all knowledge processing actions.

Organizations with greater than 250 workers should maintain information of information processing. Organizations with lower than 250 workers should maintain information in the event that they course of extremely delicate knowledge, course of knowledge frequently or course of knowledge in a manner that poses a big danger to knowledge topics.

Controllers should doc issues like the info they accumulate, what they do with that knowledge, knowledge circulate maps and knowledge safeguards. Processors should doc the controllers for which they work, the kinds of processing they do for every controller and the safety controls they use.

The controller is finally liable for making certain compliance. 

Beneath the GDPR, final duty for compliance rests with the info’s controller. This implies the controller should guarantee—and be capable of show—that its third-party processors meet all related GDPR necessities. 

Knowledge topics’ rights

The GDPR grants knowledge topics sure rights over their knowledge. Controllers and processors should honor these rights.

The group provides knowledge topics straightforward methods to train their rights.

Organizations should give knowledge topics a easy technique of asserting their rights over their knowledge. These rights embody:

The proper to entry: Topics should be capable of request and obtain copies of their knowledge, in addition to related details about how the corporate makes use of the info.

The proper to rectification: Topics should be capable of right or replace their knowledge.

The proper to erasure: Topics should be capable of request deletion of their knowledge. 

The proper to limit processing: Topics should be capable of prohibit how their knowledge is used if they believe the info is inaccurate, not crucial or being misused. 

The proper to object: Topics should be capable of object to processing. Topics who’ve beforehand granted their consent should be capable of simply withdraw it at any time.

The proper to knowledge portability: Topics have the fitting to switch their knowledge, and controllers and processors should facilitate these transfers.

Typically, organizations should reply to all knowledge topic entry requests inside 30 days. Firms should sometimes adjust to a topic’s request except the corporate can show it has a reliable, overriding cause to not.

If a corporation rejects a request, it should clarify why. The group should additionally inform the topic how one can attraction the choice to the corporate’s knowledge safety officer or the related supervisory authority.

The group provides knowledge topics a technique to contest automated selections.

Beneath the GDPR, knowledge topics have a proper to not be certain by automated decision-making processes that would have a big affect on them. This consists of profiling, which the GDPR defines as utilizing automation to judge some facet of an individual, akin to predicting their work efficiency.

If a corporation does use automated selections, it should give knowledge topics a technique to contest these selections. Topics may request {that a} human worker assessment any automated selections that affect them.

The group is clear about the way it makes use of private knowledge.

Controllers and processors should proactively and clearly inform knowledge topics about knowledge processing actions, together with the info they accumulate, what they do with it and the way topics can train their rights over knowledge.

This data should sometimes be communicated by means of a privateness discover introduced to the topic throughout knowledge assortment. If the corporate doesn’t accumulate private knowledge immediately from topics, privateness notices have to be despatched to the themes inside a month. Firms can also embody these particulars in privateness insurance policies which might be publicly accessible on their web sites. 

Knowledge privateness and safety measures

The GDPR requires controllers and processors to take steps to forestall the misuse of non-public knowledge and shield knowledge topics from hurt.

The group has carried out acceptable cybersecurity controls.

Controllers and processors should deploy safety measures to guard the confidentiality and integrity of non-public knowledge. The GDPR doesn’t require any explicit controls, nevertheless it does state that corporations should undertake each technical and organizational measures.

Technical measures embody expertise options, akin to identification and entry administration (IAM) platforms, automated backups and knowledge safety instruments. Whereas the GDPR doesn’t explicitly mandate encrypting knowledge, it does suggest that organizations use pseudonymization and anonymization wherever potential.

Organizational measures embody worker coaching, ongoing danger assessments and different safety insurance policies and processes. Firms should additionally observe the precept of information safety by design and by default when creating or implementing new techniques and merchandise.

The group conducts knowledge safety affect assessments (DPIAs) as required.

If an organization plans to course of knowledge in a manner that poses a excessive danger to the rights of topics, it should first conduct a knowledge safety affect evaluation (DPIA). Varieties of processing that would set off a DPIA embody automated profiling and the large-scale processing of particular classes of non-public knowledge, amongst others.

A DPIA should describe the info getting used, the meant processing and the aim of the processing. It should establish the dangers of processing and methods to mitigate these dangers. If important unmitigated danger exists, the group should seek the advice of a supervisory authority earlier than transferring ahead.

The group has appointed a knowledge safety officer (DPO) if required.

A company should appoint a knowledge safety officer (DPO) if it screens topics on a big scale or processes particular class knowledge as a core exercise. All public authorities should appoint DPOs as nicely.

The DPO is liable for making certain the group stays GDPR compliant. Key duties embody coordinating with knowledge safety authorities, advising the group on GDPR necessities and overseeing DPIAs.

The DPO have to be an impartial officer who stories on to the best stage of administration. The group can not retaliate in opposition to the DPO for performing their duties.

The group notifies supervisory authorities and knowledge topics when knowledge breaches happen.

Organizations should report most private knowledge breaches to the related supervisory authority inside 72 hours. If the breach poses a danger to knowledge topics, the group should additionally notify the themes. Organizations should notify topics immediately except direct communication can be unreasonable, wherein case a public discover is suitable.

Processors that endure a breach should notify the related controllers with out undue delay.

If situated exterior the EEA, the group has appointed a consultant within the EEA.

Any firm exterior the EEA that frequently processes EEA residents’ knowledge or processes notably delicate knowledge should appoint a consultant inside the EEA. The consultant coordinates with authorities authorities on behalf of the corporate and acts as the purpose of contact for GDPR compliance issues.

Knowledge transfers and knowledge sharing

The GDPR units guidelines for a way organizations share private knowledge with different corporations inside and out of doors the EEA.

The group makes use of formal knowledge processing agreements to control relationships with processors.

A controller can share private knowledge with processors and different third events, however these relationships have to be ruled by formal knowledge processing agreements. These agreements should define the rights and tasks of all events with respect to the GDPR.

Third-party processors can solely course of knowledge in line with the controller’s instructions. They can’t use a controller’s knowledge for their very own functions. A processor should receive approval from the controller earlier than sharing knowledge with a sub-processor.

The group solely conducts accepted knowledge transfers exterior the EEA.

A controller can solely share knowledge with a 3rd get together situated exterior the EEA if the info switch meets at the least one of many following standards:

The European Fee has deemed the info privateness legal guidelines of the nation the place the third get together is situated to be ample.

The European Fee has deemed the third get together to have ample knowledge safety insurance policies and controls.

The controller has taken all of the steps crucial to make sure the safety and privateness of the info being transferred.

Discover GDPR compliance options

GDPR compliance is an ongoing course of, and a corporation’s necessities can change because it collects new knowledge and engages in new sorts of processing actions.

Knowledge safety and compliance options like IBM Safety® Guardium® may also help streamline the method of reaching—and sustaining—GDPR compliance. Guardium can robotically uncover GDPR-regulated knowledge, implement compliance guidelines for that knowledge, monitor knowledge utilization and empower organizations to answer threats to knowledge safety.

Be taught extra about IBM’s suite of information safety and compliance merchandise.