Kaspersky for BusinessFighting fit: runningrings around GDPR
complianceThere’s no escaping it – the General Data Protection Regulation(GDPR) is coming and no matter what part of a business you
work in, be it HR or marketing, legal or IT, it will affect you andhave an impact on your working day. If you handle, hold or use
personal data – whether it’s employee details, customer orprospect information – GDPR will bring change to your working
practices and it’s up to you to make them.

Bearing the burdenof GDPR
“Adhering to data
privacy regulation
is nothing new forcompanies basedin the EU.”
Before we can break down thechallenge ahead, it’s important tounderstand the key changes1 thatwill affect you:
• All personal data you control andmanage – regardless of whether theprocessing takes place in the EU or not– will need to be processed fairly andtransparently, with clear usage given to
the data subjects (i.e. citizens).
• Severe financial penalties will apply
for breach of regulations – up to 4%of annual global turnover or up to €20
million (whichever is greater).
• Stricter consent will be needed for datausage, making it just as easy for citizens towithdraw consent should they request it.
• Data breaches must be notified within
72 hours of the data controller becoming
aware.
• Data subjects will have improved rights
to obtain confirmation about how, whereand for what purpose their data is being
processed.
• Data erasure (or “the right to beforgotten”) will be made easier, withdata subjects able to request that theirpersonal data be erased or processing
stopped (providing their request meets
certain conditions).
• Data portability will be enabled, givingdata subjects the right to receive personal
data concerning them.
• Data protection processes (or “privacy bydesign”) must be included from the outset
of designing new systems, rather than anadd-on later.
• Data protection officers will become
mandatory for those whose core activities
consist of processing operations which
require regular and systematic monitoringof data subjects on a large scale, orin some cases where companies areprocessing significant volumes of ‘special
category’ data.

Much like a personal trainer gives you the motivation and structure to succeed,
this guide will set out a plan of attack, to help cut through the noise and get
you over the line to achieve your GDPR goal of becoming compliant.
Adhering to data privacy regulation is nothing new for companies based inthe EU. But when GDPR is enforced on 25 May 2018 – replacing the Data
Protection Directive 95/46/EC – they will need to be ready to cope with a new
approach to data privacy, which empowers EU citizens to have more control
over their personal data and what happens to it.
With much of the hype and focus to date firmly on the readiness of companies
across Europe to meet the new criteria – and the associated fines if they don’t
comply-what does it all mean for individuals within a company and is theburden they face bearable?
Despite these key changes, much of the ground work has already been
done under existing data protection regulations. Far from being a burden,
the stringent nature of GDPR is a good thing for businesses and can haveuntold benefits for the future health and well-being of their organisation if
approached in the right way.
Whilst those above you might have the wheels in motion for dealing with thebigger picture, each employee needs to be up to the challenge of getting
the health of their data in order. The security and safe keeping of data inyour possession will become of even more importance. With the goal andobjectives of GDPR firmly set, it’s up to the entire business to pull together toreach this key compliance milestone and streamline their data management
practices across the board.
Much like tackling a change in lifestyle or objective to get fit and healthy forthe summer months, approaching GDPR at a departmental level can only beachieved by making small, but significant changes which all come together
to ensure you are fighting fit for when GDPR enters the ring in 2018.

1

http://www.eugdpr.org/key-changes.html

1The sales and marketing
migraine“Isn’t GDPR only
Common complaints
going to slow us
The sales and marketing machine is typically focused on using customer
and prospect data to drive sales leads and enhance brand awareness.
down and add toWith vast databases and targeted campaigns, the department already has
to adhere to strict data protection guidelines and operates an opt-out policythe red tape ofto ensure compliance.
getting our email
The GDPR effectcampaigns and sales
If you use personal data to deliver targeted marketing and sales campaigns, thenteam in front of the you must adhere to the updated regulations. Relying on pre-ticked boxes onforms, or marketing to people who haven’t specifically unsubscribed will noright people?”
longer constitute consent. Explicit, opt-in consent is required for processing
Departmental data detox:• So where do you start? Instead of taking
a knee-jerk reaction or “binge diet”
approach to dealing with your data
dilemma, if tackled in the right way,achieving long term data health andGDPR compliance can be easier than itseems.
• Bite sized, achievable health and fitnessplans with clear goals and milestones will
ensure every department is fighting fit tocombat anything GDPR throws at them,and help steer the business towards longterm data health with no chinks in thearmour or weak parties bringing it down.

sensitive personal data, however for non-sensitive data “unambiguous” consent
is valid. Provision for deletion of data also needs to be made under “the right tobe forgotten”, which will make it easier for individuals to ask for their information
to be removed from your database.

Your five-step data fitness plan
• Opt-outs, or those who remain silent, must now opt-in or give explicit
consent in some way if you want to keep them on your marketing hit list.
But before you trawl through your entire database, think about the best way
to enable this to happen to give you a valuable and cleansed marketing list
as a result.
• Your database needs to opt-in and respond, so give them a reason to do
so with a strong call to action and compelling content.
• Under the terms of GDPR, consent text accompanying marketing material
needs to be clear and concise, making it easy for people to make a decision
about if and how you can use their data.
• Keep a clear audit trail and record of who has opted-in.
• You need explicit consent to market to an individual – attendance at anevent or business card left at a trade show is not sufficient to add themto your marketing mailer database. They either need to explicitly untick abox to show clear, affirmative action or actively provide another statement
or action which clearly indicates the data subject’s acceptance of theprocessing or their personal data. This could include providing their email
address in an optional section in an online form, which has a supporting
disclaimer about its usage.

2

The legal low
Common complaints“Ensuring our staff
understand and stick The legal team already has to deal with a raft of regulations to ensure thecompany adheres to data privacy and protection laws and they would beto the rules and that forgiven for dreading the impact of GDPR on their day to day roles.
our contracts andThe GDPR effectsupplier SLAs meet
Not everything needs to fall on the shoulders of the legal department. However,
GDPR compliance,
there are key areas which they need to address. Managing contracts andnegotiating with clients and suppliers is one such area. Under GDPR, your businessis going to put awill be liable for any breach of rules associated with the data processed either
in-house of via a third party or through partners you work with, so ensuring
huge strain on ourcompliance across the board is vital. From your internal teams and marketing
database, to your PR agency and outsourced data centre: if rules are not followedresources.”or a breach occurs, it will have a significant impact on your business. Ensuring you
Only

38%

of IT decision makers have a goodknowledge of GDPR

have robust data safeguarding policies in place is paramount.

Your five-step data fitness plan
• Any contracts which extend beyond the GDPR deadline, will need to bereviewed and updated as necessary, to ensure they meet the new dataprocessing regulations.
• Ensure that any new contracts or negotiations take GDPR into account, tosave last minute panic a year down the line when things need to be changed.
• This can be done by adding in specific clauses which mean they can be easily
amended to comply with GDPR when it comes into effect.
• To make this easier when the time comes, signpost when these changes needto happen in project plans or timelines.
• Work with your suppliers to ensure compliance. The regulations affect them
too and by working together you can maximise resources and ensure a robust
response on both sides, so that all parties know what their responsibilities areshould a breach happen or data subject make a request about their data.

3

The finance andaccounting Achilles heel
32%of IT decision makers have minimal or noawareness that EU businesses must report
a data breach within 72 hours under GDPR

Common complaints
The finance function is a highly-regulated area and already firmly in theaccountability firing line, processing vast amounts of sensitive and personal
information every day.

The GDPR effect“GDPR is going toDue to the volume of personal data they work with, the finance and accounting
function will become a big focus for the data protection officer and thehave a huge impact
regulators who are tasked with ensuring GDPR compliance. The security ofon the way we work, personal information moving across their systems is where the big fines cancome, if any breach occurs. But, with the function already used to operatingwith even more eyes under strict regulatory controls, GDPR will only help to strengthen the robustand transparent nature of the finance function.
on our departmentYour five-step data fitness plan
to ensure we are• Ensure there is a clear escalation process in place within the department
processing andto immediately report any data breaches to the authorities, should theworst happen.
securing data to the• A data audit will assess what changes you need to make to current practices
to ensure compliance. This won’t mean starting again with policies but
letter of the law.”
updating them to ensure you tick the new GDPR boxes.
• Automating processes will help to reduce human error and reduce the risks
associated with the data breaches – whether intentional or unintentional.
• Review data storage procedures which cover the retention and destructionof personal records, as the parameters will change under GDPR.
• Put data protection at the heart of all processes moving forward and don’t
think of it as an add-on, but a core part of doing business.

4

The HR headache
29%

of IT decision makers have minimal or
no awareness that the regulations apply
to EU personal data stored inside andoutside of Europe

Common complaints
HR holds a great deal of personal data – from CVs of existing and former staff,
as well as unsuccessful candidates, through to employee data including contact
and banking details.

The GDPR effect“With storage,Under GDPR, employees will have enhanced rights over the use and retentionof their data, giving employers a potential headache. But whilst the impact upon
HR is significant, the challenge is not insurmountable. The department will needsafeguarding andto be more transparent about their intention for the personal data and provide
the ability for employees to request it be suppressed. This applies to current anddeletion of HRformer employees.
data already acumbersome task
Your five-step data fitness planand regulatory• To relieve pressure on HR, an audit of current data handling processes
and policies is the first logical step to understand where any changes needheadache, surely
to be made.
• This will help ascertain where updates need to be made to employee
GDPR will only bring
contracts, handbooks and company policies.
• Empower those in your team by providing more information to employees
the department
and job applicants on the purpose and legal grounds for collecting theirdata and ensuring they know their rights.
more pain?”• For prompt response to a data breach, nominate a response individual orteam to react to any incident.
• Regular training in how to identify and respond to a breach coupled withappropriate policies will ensure this aspect of the regulation is tackledcalmly and with confidence.

5The IT irritation“ My remit doesn’t
include holding or
managing personaldata, so why should
I care about GDPR?”

22%of IT decision makers are not confident
that their organisation will be fullycompliant with GDPR by May 25 2018

Common complaints
For IT professionals, keeping the company’s infrastructure running and systems
robust and reliable is their number one challenge. GDPR is not something that is
explicitly on their radar. However, effective IT processes underpin the very fabricof ensuring and maintaining GDPR compliance and achieving a streamlined,
secure and transparent approach.

The GDPR effect
GDPR will affect the IT department in a variety of ways and cross over with otherdepartments, as they update and streamline their processes. For example, themarketing team will require support for their opt-in and email campaigns, to ensure
the technology is there to keep track of consent forms etc. With greater onus on
citizens being able to access their information and have it removed or to have abetter understanding of what it is used for, systems and programs which hold thisinformation must be easy to navigate and ensure complete transparency for thoseusing them. Securing the data held by your organisation is also vital.

Your five-step data fitness plan
• Work with other departments in the organisation to understand their needs
and how it affects the software and systems they use and what support theyneed in order to comply with GDPR.
• Catalogue every piece of personal data to ensure transparency and easy
access to information as needed for reporting purposes or to fulfill data
subject requests.
• Set up clear audit trails for every piece of personal data moving in and outof the organisation.
• Apply privacy specific measures to safeguard information and minimise
the likelihood and impact of data breaches, including encryption andanonymization.
• Address GDPR requirements at the planning stage of any new software or
infrastructure updates, to ensure it complies and that data is secure andintegrity maintained.

6

As much as

17%of IT decision makers say their organisation
has made little or no preparations for GDPR

Call to action: Group exercises
The task ahead might look daunting, but businesses and individual departments
are already making good progress in getting their data health in order. To help
get them over the line and keep the business running at peak condition, habits
towards the security of personal data need to be strengthened and maintained
across the board.

Your five-step data fitness plan• Go the distance – There is no long-term reward in taking a half-hearted
approach to getting your business GDPR-ready. Future proofing new proceduresis key. It could cripple your business if the right steps are not taken now.
• Nominate a coach – Each department needs someone to bring it all together
and keep everyone on track and to plan.
• Clear your mind – Achieving departmental and organisation change requires
an open mind and willingness to change processes for the long-term healthof the business.
• Train regularly – Data protection policies need to be regularly updated andclearly communicated to all departments, staff and suppliers.
• Work with a personal trainer – Third party support will not only help you
to stay on track but help you maintain good data health moving forward.

Unless stated, all statistics included inthis whitepaper are taken from research
conducted for Kaspersky Lab by Arlington
Research in April 2017. Over 2,300 IT
decision makers from across Europe,
within companies of 50 or more employees,
were questioned about their views andawareness of GDPR.

For more information about Kaspersky products and services
contact your account rep or visit www.kaspersky.com
Kaspersky LabKaspersky Lab, 1st Floor
2 Kingdom StreetLondon, W2 6BD, UK
www.kaspersky.com© 2017 AO Kaspersky Lab. All rights reserved. Registered trademarks and service marks are the propertyof their respective owners. Mac and Mac OS are registered trademarks of Apple Inc. Cisco is a registeredtrademark or trademark of Cisco Systems, Inc. and/or its affiliates in the U.S. and certain other countries. IBM,Lotus, Notes and Domino are trademarks of International Business Machines Corporation, registered in many
jurisdictions worldwide. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.
Microsoft, Windows, Windows Server and Forefront are registered trademarks of Microsoft Corporation in
the United States and other countries. Android™ is a trademark of Google, Inc. The Trademark BlackBerry isowned by Research In Motion Limited and is registered in the United States and may be pending or registeredin other countries.

7