GDPR: How Much Compliance is Enough?

I was asked the equivalent of the subject question the other day, and realised that perhaps the demonstration of compliance is not quite as obvious as I have made it out to be in previous blogs.

And by ‘obvious’ I don’t mean ‘simple’, because this has always been simple.

The word ‘appropriate‘ appears 115 times in the GDPR final text, and the word ‘reasonable‘ a further 23, but if you don’t know how to define those things in relation to compliance for your organisation, how do you know when you’ve done enough? Or too much? The balance is as important to your business as compliance itself.

Continue reading

Getting from 'Paper' Policies to Regulatory Compliance

I have lost count of the number of times I have stated the equivalent of; “Without good policies you’ll never have real security. “. Then again, security is what I do for a living, so it’s obvious to me, but clearly it’s not obvious to the thousands of organisations who think policies are just pieces of paper you use to tick a compliance box.

Then it occured to me that maybe organisations just don’t know how to take a policy and turn it into something that can be used to both demonstrate and validate adherence to a regulatory compliance regime such as GDPR or PCI. Or perhaps just as importantly, pass a due diligence audit for a potentially huge client.

Continue reading

Are Data Protection Laws Hurting International Business?

[Note: For this blog I’m going to focus on US-based ‘content’ providers (e.g. newspapers) as these folks seem to be the ones hit particularly hard by EU legislation.]

From May 25th 2018, we have all likely encountered at least one of these notices when browsing US-based websites:

Continue reading
GDPR Expert

Finding the Right GDPR ‘Expert’ to Help Your Business

I have lost count of the number of times I have included phrases like; “You have to ask the right questions.” into my blogs, or into conversations with prospective clients. One of my primary roles as a consultant is to to either help my clients do just that, or to give them the right answers first if they are just too far behind the curve.

Continue reading
Representative

GDPR: How Will ‘Representatives’ Work?

Even as a data protection novice, the GDPR makes sense to me. I get it. I may be partly wrong in some assumptions, but I am comfortable enough in my understanding of the intent of the Recitals and Articles to ask the right people the right questions.

All, that is, with the exception of Recital 80 / Article 27 – Representatives.

Continue reading