This is the final part in my GDPR Step-by-Step series, and one that, in my cynicism, I see very few organisations even trying to attempt. I have lost count of the number of companies with whom I have tried to implement a continuous compliance program, only to have them stop once they received their initial ‘certification’. In this respect, GDPR will be no different from something like PCI.
Continue reading “GDPR Compliance Step-by-Step: Part 6 – Operationalise”Tag: Data Protection
As a consultant there’s nothing I like more sitting around a table with a bunch of really smart people simplifying complex issues and guiding them towards an appropriate and effective security program.
Then someone has to go spoil the ride by saying; “That sounds great David, when can we expect the report?” [sob]
‘Documentation’ really should be a 4-letter word.
Continue reading “GDPR Compliance Step-by-Step: Part 5 – Documentation”Taking a week’s break from my Step-by-Step series in order to have one final rant [I promise] about the use of GDPR fines/penalties in marketing material. Hopefully this third attempt will sort the problem out once and for all, I DO have 400 followers after all.
In my business, I am advising everyone who will listen to not do business with ANY organisation using fear, uncertainty and doubt (FUD) as a tactic to sell. If they were offering decent services they would not have to resort to such unprofessional and unethical practices.
Continue reading “Do Not Hire Companies Using GDPR Fines as a Sales Tactic”If you are looking for a clear and legally accurate treatise on how to apply the 6 lawful bases for processing to your business, you have:
- not read any of my previous blogs;
- probably not read the GDPR itself; and therefore
- come to the wrong place
If you have performed the data discovery exercise laid out in the last GDPR Step-by-Step blog, you will now have a bunch of data with only limited context. For data to become information, you need to provide the appropriate context, which in GDPR terms, is in the form of a ‘business process’.
Every department has at least one, and likely several individual processes that handle personal data, each in their own way. All of these need to be defined as they will each require a determination of their lawful basis for processing, and will correspond directly to the record keeping requirements of Article 30.
Continue reading “GDPR Compliance Step-by-Step: Part 3 – Process Mapping”