As a consultant there’s nothing I like more sitting around a table with a bunch of really smart people simplifying complex issues and guiding them towards an appropriate and effective security program.
Then someone has to go spoil the ride by saying; “That sounds great David, when can we expect the report?” [sob]
‘Documentation’ really should be a 4-letter word.
Continue reading “GDPR Compliance Step-by-Step: Part 5 – Documentation”Taking a week’s break from my Step-by-Step series in order to have one final rant [I promise] about the use of GDPR fines/penalties in marketing material. Hopefully this third attempt will sort the problem out once and for all, I DO have 400 followers after all.
In my business, I am advising everyone who will listen to not do business with ANY organisation using fear, uncertainty and doubt (FUD) as a tactic to sell. If they were offering decent services they would not have to resort to such unprofessional and unethical practices.
Continue reading “Do Not Hire Companies Using GDPR Fines as a Sales Tactic”If you are looking for a clear and legally accurate treatise on how to apply the 6 lawful bases for processing to your business, you have:
If you have performed the data discovery exercise laid out in the last GDPR Step-by-Step blog, you will now have a bunch of data with only limited context. For data to become information, you need to provide the appropriate context, which in GDPR terms, is in the form of a ‘business process’.
Every department has at least one, and likely several individual processes that handle personal data, each in their own way. All of these need to be defined as they will each require a determination of their lawful basis for processing, and will correspond directly to the record keeping requirements of Article 30.
Continue reading “GDPR Compliance Step-by-Step: Part 3 – Process Mapping”In truth, this should be called Data Discovery & Asset Management, because there’s absolutely no point having one without the other. Nor should these things not already be part of your standard practices.
It’s 2018 and I can think of very few businesses who don’t have data as some of their most critical assets. No businesses bothering to read my blog anyway. So if data assets are that critical, why don’t you already KNOW where all of your personal data is? Why don’t you already have a record of who has access to it, and what they are doing with it?
Continue reading “GDPR Compliance Step-by-Step: Part 2 – Data Discovery”