Guide: GDPRCompliance
The Next Chapter

In the run-up to May 25, 2018, the day that
the EU would start enforcing the General
Data Protection Regulation (GDPR), manyorganizations were in a mad sprint to ensure
they would be ready to comply with these newrules for the collection, usage, storage, andmanagement of personal data.
Was this true for your org? If so, you were
not alone.
Not surprisingly, despite the best intentions,
reports suggest that many companies probably
would not have passed an audit on May 26th.
But even for teams whose personal data policies
and practices are now in compliance with theGDPR, it’s important to remember that this is
not a one-and-done task.
atlassian.com/gdpr

In the last year, it’s likely yourorganization took on new projects
or programs that impacted its
personal data-gathering practices.
Likewise, your infrastructure willgrow and evolve, and it will be
critical to document your datacollection and storage policies
and operations. And as you hire
new employees or individuals’
roles change, you’ll need tomake sure everyone knows their
responsibilities for protecting
customer data.
We know that any complianceprogram is an ongoing effort. With
the GDPR and other data privacy
regulations looming on the horizon,
we’re committed to working withour community of customers andpartners to help you secure personal
data and maintain compliance.

Known fact: The financial
consequences of GDPR can be severe
If there were questions about
how strenuously the EU would
enforce their new rules, those
have now been answered. The
financial consequences of failingto comply with the GDPR canbe steep, as we’ve seen withGUIDE: GDPR COMPLIANCE

recent fines. According to the law,
penalties run up to €20 million, or
4% of worldwide annual revenue,
whichever is greater.
This past January, Google wasfined €56 million for failing to get
informed consent from customers
for the use of their personal data.
It can be argued that Google
attempted to get proper consent,
though the language was spreadout over multiple pages of content.
It’s apparent that, to regulators, it’smore important to follow the spiritof the law — truly helping individuals
understand how you’re using theirpersonal data — than technicallycomplying with the letter of the law.
But it also appears that goodfaith efforts count in the eyes ofregulators. An unnamed Germansocial media platform was finedfor data breaches that exposedcustomer data, including passwords.
But due to their prompt reportingand cooperation with regulating
authorities, the penalty was only
€20 thousand.

2

Main elements of the regulation
The intention of the GDPR is to acknowledge the value of personal data
and the agency individuals have over their own personal data. Article 5
explains the spirit of the legislation:
1. Data should be processed with the fair consent of the data subject,transparently, and in accordance with the law.
2. Data will be collected and used for the purposes you give to the data
subject, and not beyond this. (There are some exceptions, in the caseof using data for the “common good.”)
3. Only collect what you need, and no more. This benefits both the data
subject and your organization; no sense in being responsible forprotecting data you don’t actually need.
4. Data should be maintained for accuracy, and when it is no longer
accurate or up to date, steps should be taken to rectify this or delete
the data.
5. Data should be kept in a form that identifies data subjects only for as
long as is necessary and discards the data when it’s no longer useful.
6. Data should be stored in a way that preserves its integrity andconfidentiality.

GUIDE: GDPR COMPLIANCE

3

Create a framework that builds
trust across the organization
Beyond fines, there is anotherincentive to comply with theGDPR: demonstrating yourorganization’s respect for personal
data and building trust among
your customers and partners. ButIT organizations cannot do thison their own. This level of care for
personal data requires participationand commitment from every armof the company, and demands anorganizational framework thatguarantees everyone knows theirroles and responsibilities.
Think of this as a people-processdocumentation framework, theultimate goal being to provide totaltransparency into the personal data
you control and process internallyand externally. Not only will you
be able to prove compliance, but
your product, sales, and marketing
teams may also be able to leverage
your personal data policies andprocedures to build trust among thepeople you do business with.

The basic elements ofthis framework are:Gather a crossfunctional“Tiger Team”

Document
policies, practices,and procedures

Audit to trackchanges forcontinuous
improvement

Provide ongoingtraining soemployees know
their responsibilities

GUIDE: GDPR COMPLIANCE

4

Build a team to spread the word and enforce policies
Before you assemble yourTiger Team, determine what typesof personal data you need to collectin order to function as a businessand deliver the best product orcustomer experience.
You’ll want representatives frommany parts of the organization, as
it may not be obvious who collects
personal data, for what purpose,and how they manage it, especiallysince some people may have accessto third-party SaaS products that areinvisible to the IT organization.
This probably goes without saying,but make sure your legal counsel
is included in your Tiger Team. Not
every organization has the same
responsibilities, and you’ll wantto both make sure you’re legally
covered and that you aren’t taking
on more than you’re required to do.

This team isn’t necessarily
responsible for actually writing
policy; you probably don’t wantdata security policies devised by alarge committee. Instead, use thisgroup to determine the breadthand depth of your organization’s
data collection and management

requirements, and then appoint
them to communicate thepersonal data management rules,
policies, and processes to theirrespective teams.

Educate each team on their
responsibilities
Each team member needs to understandthe policies and procedures involvedin obtaining consent to use personaldata, as well as their responsibilities forstorage and deletion.
Here’s an example of a potentiallychallenging situation: Using a third-party
tool, a product manager conducts asurvey of potential customers, asking for
personally identifying information so she
can conduct follow-up interviews.
First, she should ensure that thecontractual language addresses how
the third-party vendor will protect, limit
use of, and delete the customer datacollected during the survey.
Second, the Product Manager shouldhave a plan for disclosing to the survey
participants what she intends to use
the data for, and how long she intends
to keep the data. She also needs to get
consent to collect and use the data.
Finally, she should plan for how to store
and securely dispose of the data once
she no longer needs it.
5

Do I need a DPO?
Not everyone needs a dedicated Data Protection Officer (DPO). According to
the UK’s Information Commissioner’s Office, you need a DPO if:· Your organization is a public authority or body (except for courts acting intheir judicial capacity).

· Your core activities require large-scale, regular, and systematic monitoring ofindividuals (for example, online behavior tracking).

· Your core activities consist of large-scale processing of special categories ofdata or data relating to criminal convictions and offenses.

Even if none of these situations apply to you, you may want a point-person
charged with running your GDPR affairs. Just know that anyone whocarries the title “DPO” is subject to very specific tasks, obligations, andresponsibilities under the law. Make sure you document how you’ve decided
to handle the leadership and coordination of your governance team to showthat you’re in compliance with the GDPR’s principles of accountability.
GUIDE: GDPR COMPLIANCE

6

Document your data collection, management
policies, and procedures
In the event that you’re audited
for GDPR compliance, you will haveto produce documentation thatdetails what data you collect andhow you manage it. You’ll also wanta written record of your policies
and procedures in order to track
tweaks and changes as yourbusiness evolves.
This documentation should beappropriate for the size andcomplexity of your organization.
Don’t make it so detailed thatyou’re burdened by the upkeep, but
do comprehensively record yourdata processing activities, andmake sure your breach detection
and notification plans are in place.
As was the case with the Germansocial media platform, even if you
are audited and get dinged for an
infraction, your documentation canshow your good intentions, and yourfine may not be as severe.

Some key elements to include
in your documentation:·· Personal data: What personal data
do you collect? How long will it beuseful? When will you delete it?

·· Process analysis: Know which
processes involve personal data andwhy, and make sure you can justify
the lawful use of this data.

·· Responding to data subject
access requests: Know how yourorganization will respond to data
subjects’ requests to view, port, ordelete any or all of their data.

·· Communicating breaches: Under theGDPR, you must report data breaches
to regulators and notify anyone who
may be affected. Work with yourcommunications team to develop acrisis comms plan.

·· Information security management
systems: State which methodologies
your org uses for testing security,
noting any standards or bestpractices you follow, and any
certifications you’ve received.

And if you’re only recently subject to the GDPR and you’re still developing
your operations, consider documenting these plans in the form of aroadmap, complete with features and timelines, so everyone can see where
you are and what’s left to be done.
GUIDE: GDPR COMPLIANCE

7

Audit for organization-wide compliance
Regardless of whether or not you are obliged to have a Data Protection
Officer, you’ll definitely want someone to lead the internal audits of yourpersonal data management and security practices. How often you need toaudit depends on how quickly your business changes, both in your practices
and in personnel.

There are many ways to approach an audit. In general, you should:·· Audit for gap analysis between your current data protection and security
practices and the GDPR rules.

·· Get everyone who handles personal data to document what personal data
they have, how it is used, where it is stored, and if and when it should besecurely deleted.

·· Request audit results and proof of compliance for all of your vendors who
handle personal data to ensure they’re following the rules of the dataprocessor and have the proper security controls in place.

·· Conduct a risk assessment to stay on top of your most vulnerable areas. Andagain, update this as your business changes.

GUIDE: GDPR COMPLIANCE

8Build awareness and offer ongoing training
Once your policies and procedures
are in place, it’s important thateveryone in your organization isaware of their responsibilities forhandling personal data and how
to make sure the organization
stays compliant.
Members of your “Tiger Team”
can be charged with conducting
regular training with existing andon-boarding personnel. Make surethey have access to up-to-date
information that’s specific to yourorganization’s practices. They will
also need to know how to respondif a data subject makes a request
regarding their data, and, of course,
how to handle the reporting of abreach or other infraction to thegoverning authorities.
And while vendors themselves
are fully responsible for their own
data handling standards andprocedures, it’s good practice
to share information about yourGDPR operations. This level of open
communication and transparency
can be vital your business inthe event you have to work
together through a personal data
management infraction.

For more information and updates on
our GDPR compliance practices, visit
atlassian.com/gdpr.

Glossary of terms·· Data Controller: This is the natural orlegal person, public authority, agency,
or other body that determines thepurposes for and means of processing
personal data. An example: Google isthe controller for the data associatedwith Gmail accounts.

·· Data Processor: This is a natural or

legal individual, public authority,agency, or other body that processes
personal data on behalf of theController. An example: A cloud-based
online survey tool processes personal
data on behalf of its customers.

·· Data Subject: Is a natural person who

can be identified, directly or indirectly,
by reference to an identifier such asa name, an ID number, location data,or an online identifier, or by one ormore factors specific to the physical,
physiological, genetic, mental,economic, cultural, or social identity ofthat natural person.

·· Subject Access Request: Individual

Data Subjects can make requests
to access their personal data, either
verbally or in writing. Generally,organizations have one month torespond to the request. Subjects canask to see their data, port their data
to another company, or delete theirdata in part or in full. They can also
ask to have any mistakes corrected.
9