GDPR executive briefing

Exec summary

By May 25, 2018, any company doing business with subjects of the European Union must comply with the GDPR’s stringent rules or face fines up to 4% of revenue. Underpinning the regulations is the principle of “Privacy by design” which means compliance cannot be an add-on, but must be baked into the operational DNA of the organization.

Gartner predicts that by the end of 2018, more than 50 percent of companies affected by the GDPR will not be in full compliance with its requirements. A recent survey by PwC revealed that 92% of U.S. multinational companies cite GDPR as their top priority and 9% are expecting to spend over $10m. This is a board level issue.

GDPR and recent data breaches have put data privacy in the spotlight. Organizations that move fast to demonstrate “privacy by design” will earn the trust, confidence and deeper engagement with customers. For many companies GDPR compliance is not a choice. How they choose to turn it to their advantage is.

Main article

Background

By May 25, 2018, any company doing business with subjects of the European Union must comply with the GDPR’s stringent rules or face fines up to 4% of revenue. Underpinning the regulations is the principle of “Privacy by design” which means compliance cannot be an add-on, but must be baked into the operational DNA of the organization.

GDPR — what is it?

The General Data Protection Regulation (GDPR) is the new data privacy regulation jointly proposed by the European Parliament, the Council of the European Union and European Commission, aiming to “strengthen and unify” data protection laws for individuals within the European Union. GDPR consists of 99 Articles, plus 173 Recitals, which provide explanatory text to aid interpretation of the Articles. The new regulation plans to replace the old Data Protection Directive [95/46/EC], which has been effective from 1995.

Who is affected by GDPR?

GDPR applies to organizations…

• Holding or processing personal data of subjects residing in EU
• Offering goods or services to EU citizens
• Monitoring behaviors of EU data subjects

The law applies to any company whose data processing concerns private data of EU data subjects, irrespective of the company’s (processor or controller) location.

The impact

The GDPR goes into effect in May 2018, but few businesses are ready and realization is setting in that:

• GDPR is real and not going away
• A wide range of stakeholders participate in GDPR compliance
• Privacy by design isn’t a one-off exercise
• Compliance requires understanding and control of data, processes and IT systems
• It is a huge task

A study carried out by Dell in 20161 revealed that over 80% of companies surveyed “know few details or nothing about GDPR,” and 97% had no plan to be ready for GDPR. Awareness is building but there are less than 200 days to go. Gartner predicts that by the end of 2018, more than 50 percent of companies affected by the GDPR will not be in full compliance with its requirements. A recent survey by PwC revealed that 92% of U.S. multinational companies cite GDPR as their top priority and 9% are expecting to spend over $10m. This is a board level issue.

There are several myths or misunderstandings around GDPR

• It only affects EU companies. Not true
• It is about securing and encrypting data: Not true
• Companies need to locate their data in the UE: Not true.

The greatest barrier to taking action is that companies believe it that it doesn’t affect them or that they will not be caught and fined. This is missing the point. This should be the catalyst to rethink your customer engagement strategy and build loyalty that is a huge differentiator and competitive advantage.

Benefits not fines

Whilst fines of 4% of revenue focuses the mind, there are huge benefits to be gained from transforming the way you handle customer data:

Reputation: Trust can disappear overnight with a data breach or reported misuse of personal information. Complying with GDPR can be used as a competitive differentiator and something to shout about, not just a way of saving you from becoming another data-breach statistic.

Data simplification: You must delete the data you don’t need or have permission to hold — including all that duplicated data. With less data that is more accurate you will see immediate savings. A survey showed staff spend 18% of time looking for the right information and then confirming that it is correct.

Process improvement: GDPR impacts touches all customer facing areas of your business and requires you to have documented and version controlled processes. Documenting processes drives out improvements and quick wins. We typically see 25% improvements in productivity, and often more, when using a proven process mapping approach.

3 practical steps

Once you have assessed if you need to comply with GDPR there are 3 steps you need to take.

Job #1 — Where is the Personal Data stored: You need to take an inventory of all your internal systems and build a data catalog of each systems down to field level.

Job #2 — Get explicit opt-in consent: You need to get explicit opt-in consent from all your customers, and delete all the data that you hold that doesn’t meet the criteria

Job #3 — Develop & deploy operational processes: There are specific processes that need to be documented, understood and followed; getting opt-in consent, Subject Matter Access requests, reporting data breaches.

The final word

GDPR and recent data breaches have put data privacy in the spotlight. Organizations that move fast to demonstrate “privacy by design” will earn the trust, confidence and deeper engagement with customers. For many companies GDPR compliance is not a choice. How they choose to turn it to their advantage is.

Resources

GDPR home page http://www.eugdpr.org/

PwC survey https://pwc.to/2juIDe0

Gartner assessment https://www.gartner.com/newsroom/id/3701117