What to do if you missed the GDPR deadline

Also implementing a Data Protection Officer (DPO) is crucial. Whether you decide to do it in-house or as a managed service from a third party security company, having a DPO sends a clear message to regulators that you are serious about GDPR compliance. These are the actions regulators are looking for; to expect every company to become GDPR compliant overnight is extremely ambitious.

1. Determine Your Role Under the GDPR

Any organization that decides on why and how personal data is processed is essentially a “data controller.” The GDPR applies therefore to not only businesses in the European Union, but also to all organizations outside the EU processing personal data for the offering of goods and services to the EU, or monitoring the behavior of data subjects within the EU. These organizations should appoint a representative to act as a contact point for the data protection authority (DPO) and data subjects. One method of determining if your organization falls under the scope of GDPR is to have a GDPR Readiness Assessment. These questions can help you determine if your organization needs to worry about GDPR at all. However it is important to know that the GDPR is the beginning of privacy laws for individuals and it is widely believed that the United States and other countries will eventually follow suit.

3. All data activities must have a well defined and clearly understood process of operation going forward.

Very few organizations have identified every single process where personal data is involved. Access privileges, data quality, and data relevance should be decided on when starting a new processing activity. This includes all areas on your website were form fills or tracking resides (such as google analytics, mail chimp, etc.). Organizations must demonstrate an accountability and transparency in all decisions regarding personal data processing activities moving forward. Third party companies must also comply with requirements that can impact the personal data and processes in use. It is important to note that accountability under the GDPR requires proper consent during acquisition and registration from the user. Pre-checked boxes and implied consent are no longer acceptable forms of “Opting-in”. A clear and expressed action to obtain and use personal data of the subject is needed with the option to withdraw. If you need help designing such a procedure you can reach out to MDS for more information  via email.

5. Prepare for Data Subjects Exercising Their Rights

Data subjects have extended rights under the GDPR. These include the right to be forgotten, to data portability and to be informed in the event of a data breach. If a business is not yet prepared to adequately handle data breach incidents and subjects exercising their rights, now is the time to start implementing additional controls. Similar to the “opt-in” requirements for your website and email lists, you want to then give your data subjects the opportunity to “opt-out” of all communications. The data subjects should also have the ability to completely be erased from your database. This “Right to be Forgotten” is to protect the data subject in the event of a data leak, as well as give the data subject control over their personal information and how it is being used. If you complete these five steps you will be way ahead of the game when it comes to GDPR compliance. Please don’t hesitate to reach out to us for any help along your compliance journey.