From May 2018, all companies will need to comply with the new regulations

The impacts of the GPDR and how to be prepared for the new regulation

The GDPR – General Data Protection Regulation is approaching. From May 2018, all companies will need to comply with the new regulation despite the size of the business. According to the results of a recent study commissioned by DataSolutions, 23pc of Irish businesses here said they would be forced to close if found to be non-compliant and subject to these financial penalties.

This frightening fact shows the necessity of companies to start working on a plan to develop the required skills and knowledge to comply with the new regulation.

GDPR – Key Details

• Some companies need to appoint a DPO – Data Protection Officer – as part of their accountability program. The recommendation is that all the companies must be ready to appoint a trained professional.
• The definition of personal data under GDPR is any information relating to an individual. This includes the obvious such as name, date of birth, as well as the less obvious data such as IP addresses. The advice is: consider all information relating to an individual as data which must be protected.
• GDPR also applies to all organisations outside the EU that offers goods, services, etc within the EU or for any reason hold data on EU citizens.
• Companies must make it equally easy for a person to give and withdraw their consent for processing and storage of their personal data, and any intent to use the data for marketing must be completely transparent. Where companies employ a data controller, they need to demonstrate where consent was given.
• Data controllers (or business owners in companies that don’t employ a data controller) must immediately notify relevant authorities (e.g. ICO) in the event of a breach. Failing to do so within 72 hours incurs a substantial fine.
• To demonstrate that your company is in compliance will require things like data protection impact assessments, additional paperwork and recordkeeping.

GDPR and data storage

One fact that causes doubt in general is how the regulation applies to data storage. Whether you use the virtual or physical server, the rules are the same. The specialists say that encryption alone is not enough to prevent a breach. They recommend the following steps:

• Alphanumeric passwords are essential
• Single sign-on where possible to prevent multiple users and passwords
• Encryption of both stored data, and ‘on the move’ or shared data
• Security levels and permissions on sensitive information, e.g. HR data, costumer details, etc
• Multi-factor authentication
• Make sure that your BYOD policies are robust and people follow it.

IT Suppliers

IT suppliers play a significant role regarding data protection. Some businesses might think their IT supplier will be partly or wholly responsible for safe storage of their data, but in reality, it should be a group effort in collecting, storing and protecting it. Often, a data breach is caused by a user error rather than an IT fault, so businesses must address any internal issues and their processes, then work with their IT supplier to make changes.

Training Staff

The best way to address all the changes that the GPDR will bring to Irish businesses, is to invest in training of the company’s staff. This is an essential part to cope with the new regulation. If you need to change your IT policies, do it now and make sure employees understand their individual responsibility, as well as how to spot malicious attacks such as ransomware.

At New Horizons Ireland, we provide a wide range of IT trainings including the GDPR. All of them with open dates for 2017 in Dublin and conduct for an instructor highly specialized from the IAPP - International Association of Privacy Professionals.

GDPR Certifications

Other Popular GDPR courses

---

---