GDPR: What’s Next?

Businesses have raced to meet the 25th May GDPR deadline; now they’re catching their breath. But if they think the data struggle is over, they must think again.

25th May: Simply the Beginning

GDPR has put pressure on businesses of all sizes. But, while getting the documentation in place to become GDPR-compliant is one thing, ensuring there is a robust process so that the organisation remains on the right side of regulation over the long-term is an entirely different beast.

The focus must now turn to operations, and on how to survive in a GDPR-dominated world.

Step 1: Consolidate a Data Protection Team

Accountability lies at the heart of any stable process. Appointing a Data Protection Officer (DPO) – if you haven’t already – is a critical first action for businesses handling large volumes of sensitive data.

The majority of enterprises have pieced together an interim GDPR strategy. By appointing an ongoing DPO to manage operational compliance, they are pinpointing resource to translate this strategy into a scalable approach. Thus, mitigating the risk of falling back into old habits or simply not abiding by the newly-outlined regulation.

Moreover, the DPO can be the central point of contact within the business, collecting feedback and refining the approach. Weekly data management meetings, transparent reporting, and scheduled reviews will help preserve the integrity of the new setup – identifying and resolving issues before they manifest into a fine.

Step 2: Allocate Support Resource for Increased Enquiries

Be warned: customers now have the power. As such, businesses should anticipate an increased volume of inbound enquiries querying data usage or policy.

Under GDPR, there are minimum response times that must be met. Therefore, data operators must understand precisely how to triage such instances, accessing necessary information in a time efficient manner to satisfy requests.

This requires a thought-out operating model to avoid undue burden across teams. Furthermore, IT may need to consider data access rights so that individual employees have sufficient visibility of customer data to process tasks.

Step 3: Continue to Communicate Requirements

Even if the majority of your business has little access to personal information, it is vital everyone understands the ramifications of a GDPR slip-up; fines are hefty, so manage the risk accordingly.

Maintain an internal communications strategy to remind employees of expectations around data handling. Plus, help out the DPO by flagging their existence company-wide. Should crisis strike, the DPO needs to act with sufficient authority to avoid catastrophe.

Moreover, they should have the freedom to request information without having to revert to middle-management for authorisation.

Step 4: Prepare for Audits

The regulatory authorities will likely have their hands full early on. But that’s not to say businesses can expect to be immune from an unexpected audit.

GDPR is primarily about the transparency of process with visible efforts made in support of data security. As such, once a data team is in place, have them establish and detail the exact process around both data, as well as crisis, management. Be sure security policies are up-to-date, and customers understand exactly how you manage their data; as well as what they should expect in the event of any breach.

Provided you can demonstrate an effort to both notify customers as well as document your approach; should the auditor come knocking, you will have likely bought yourself time to work on any process recommendations they make.

If you cannot demonstrate effort through clear documentation, you will face the prospect of a fine – irrespective of any hidden background work.

Step 5: And Maintain Open Communications with the Authorities

Better than waiting for the unexpected audit is to keep in close contact with those who monitor compliance. Request feedback on accountability measures, demonstrate proactivity, and if you notice any level of a breach – report it, immediately.

Being upfront will both help you establish the necessary process to adhere to GDPR as well as protect yourself should something go wrong. The authority will show more leniency if they have already had dealings with you on a front-foot basis; establishing such a relationship could prove invaluable.

Step 6: Remain Compliant – and Carry On

GDPR is not out to punish business; it aims to remove the bad actors who abuse personal information. It will create industry standards that should – in the long term – enhance the consumer experience and, thus, improve the client-business relationship.

Use GDPR as a means of engaging with your customer base in plain terms; demonstrate you have their best interests at heart and seek feedback around your current communications strategy as much as your future intentions.

The risk with GDPR is businesses large and small could lose a significant portion of their audience if they don’t handle the transition well. It is important not to fear the change, or risk falling into a state of communications paralysis.

Just establish a GDPR-compliant process, then carry on.