Kaspersky for Business

The Journey to GDPR Compliance
Get fighting fit for GDPR
With May 2018 looming, the deadline tobecome compliant with the forthcoming
GDPR is coming ever closer.
The regulations will affect every businessthat deals with the personal data of EU
citizens and will call for new processes,
and tighter protection of that information.

While legal and IT teams around Europe areworking hard to put the right policies in placeat their respective organisations, it is up toindividuals to ensure that these new policies
are put into practice in their everyday working
lives. This will require a fundamental change
in the way employees think about, and treat,data within their organisations.

These steps should help everyone start their journey to becoming fit for GDPR.

1

2

BUST THE JARGONGET PERSONAL

Learn what areas of GDPR
are most relevant toyour business.

Assess the personal data
you come into contact
with in your role.

LEGAL

MARKETING AND SALES

Legal teams may be able
to help other areas of thebusiness familiarize
themselves with the areasof GDPR they alreadycomply with under current
data laws, and what stillneeds to be done.

Marketing and sales may haveaccess to the most personal
data in the business from data
capture methods. How thisdata is treated must be
properly assessed.

HR AND ACCOUNTS
4KNOW YOUR RIGHTSThe GDPR provides EU citizens
with enhanced data rights andyou must protect these. Muchof the groundwork may
already be done if you arefollowing existing data laws.

ITHR is responsible for storing,processing and deleting thepersonal information of
employees past, presentand future. This can include
highly sensitive informationsuch as medical records
and salaries which must
be protected by HR – andalso accounting.

3

IT will be key to developing
systems that allow people toaccess the information yourbusiness stores about them.
I these systems can beautomated or made available
online, your business could
save vital time and money.

Under the GDPR you may
have to tell people more
about what you do with
their data.

56

GIVE POWER TOTHE PEOPLELEARN YOURLEGAL BASIS

Put processes in place sothat you can tell people
what personal information
you hold about them.

Make sure you can explain thelegal basis for processing
personal information.

MARKETING
Marketing must consider allprocesses for data captureand how you communicate
to data subjects to gain theirconsent. It’s important that
if your company captures thepersonal data of children, that
this is done in language they
understand and with theconsent of a parent/guardian.

REVIEW YOURPRIVACY NOTICES

7
CONSIDER CONSENT
Review how you currently
seek consent for processing
data under current data
laws and update yourprocess for the GDPR.

IT + MARKETING
8THINK ABOUT
THE CHILDREN
The GDPR brings special
protection for children’s
personal data. Put systems inplace to verify ages and use
language children understandto gain data consent.

All areas of a business thattouch personal data, at any
stage of its lifecycle, musthave mechanisms built into ensure that data is kept
secure, there is consent to
use it, and it is only for its
intended purpose. IT mustbuild these systems andeveryone must use them.

910

PLUG THE GAPSBUILD A DATAFORTRESSUse a secure IT system thatwill detect, report on, andinvestigate any breachesof personal data.

Adopt a privacy-by design
approach – every processthat deals with data should
be built to protect it.

1211

THINK GLOBALGET TO KNOWYOUR DPO

Map where yourorganisation operates
and determine which dataprotection supervisory
authority you come under.

The Data Protection Officer
will be responsible for yourorganisation’s data compliance.
Meet with them regularly
to discuss your progress.

FINISH:
25 MAY, 2018
AND BEYOND