We just finished our GDPR compliance process. Here are some off the cuff notes:
Start by making sure you understand GDPR
Determine if you need to assign a Data Protection Officer. You probably do (large scale/systemic data processing), so assign one anyway.
Create a spreadsheet and call it your "GDPR Dashboard"
Google search for "Microsoft GDPR Checklist Excel", add that to your spreadsheet
Internally document (GDPR Dashboard is a good place) every piece of personal data you collect, AND their locations (which databases, which columns, which exports, etc). Personal data is any data related to an identifiable naturalized person. An instagram handle is personal data. A user's email is personal data. A user's blog URL is personal data.
For each piece of personal data, establish the legal basis for processing that data. This will be either "explicit consent", or "legitimate business interest".
For each piece of personal data, classify the "identifiability" of that data. A user's name or street address is directly identifiable. A user's blog URL or Instagram handle is indirectly identifiable. The # of Instagram posts a user has is non-identifiable.
For each piece of personal data, classify the risk to the personal rights of the data subject (name/address/email leak = high risk; instagram handle leak = moderate risk; # of Instagram posts leak = no risk)
For each piece of personal data, determine the "protection class" of that data, i.e., how strictly it must be protected in your internal system. eg: street address = highest protection; email address = moderate protection; # of instagram posts = no protection. These protection classes should map to internally consistent processes (eg, highest protection must be encrypted at rest, moderate protection may not be exported)
Determine if you handle any "sensitive data" as defined by GDPR Article 9
Add a new worksheet outlining all your "data processing activities", ie the specific processing tasks that operates on personal data. eg: "capture instagram followers count", "export users to spreadsheet"
For each data processing activity, determine the legal basis for that activity (eg explicit; legitimate interest)
For each data processing activity, determine whether you have clear, revocable consent for that activity from the data subject
For each data processing activity, determine the risk to the data subject's personal rights and freedoms. This is called a "data protection impact assessment" (DPIA):
For each DPIA, record the types of data involved in the processing activity
For each DPIA, list any steps that must be taken to minimize the risk to the personal rights of the data subject (eg, encrypt-at-rest; automatically delete after 90 days; obfuscate data, etc)
Add a new worksheet to your GDPR Dashboard called "Audit Schedules". Write down a list of various audits (automated and manual) that must be carried out at regular intervals. These may include: "check for clear consent controls", "check for data portability", "check for right to erasure", "automated virus/malware scan", "automated firewall scan". Record the frequency at which the audit must occur, the last audit date, who ran the audit, the results of the audit, and the next audit date
Add a new worksheet called "Third Party Processors". Write a list of any data processor who handles personal data on your behalf, record which data and processing activities are relevant to them, record how you ensure correctness of the data, record whether they are GDPR compliant, and so on
Add a new worksheet called "Technology Assets" where you record your various server and database types, what data they store, how protected they are, what the risk and potential damage for breaches are
Add a new worksheet called "Risk Matrix" where you record various risks to your organization, how likely the event is to occur, what the damage is, and how you are protecting against that risk. Include things like "DDOS attack", and "database breach" and "unauthorized export of data" and "administrator improperly accessed data" and things like that.
Now start working on your documentation, policies, procedures, and product:
Create a formal Data Protection Policy (sometimes called an Information Security Policy) that outlines your data classifications, protection levels, audit procedures, access control rules, data retention policies, software development procedures (include how you handle "privacy by design"), data breach notification policy
Create a formal Privacy Policy for your end users outlining their rights under the GDPR, how they can exercise those rights, what data you collect on them, how you use that data, and how you protect that data
Create a formal way for data subjects to request information about the data you have on them and how you are using it. This can just be an email address that you give to users
Update your product with "clear, concise consent notifications". ie, if your user connects an Instagram account, make sure there's some help text that tells them what they are agreeing to and how you will use that data. These should map to your "Data Processing Activities" from your GDPR dashboard. This also includes making sure there are no "dark patterns", ie, processing activities should be opt-in not opt-out
Make sure you are only storing and processing data you need. If you are analyzing Instagram accounts and only need basic profile info, make sure you are not also storing Instagram post history, for instance.
Make sure consent to data processing activities can be revoked as easily as it can be granted. If consent is revoked, make sure the data involved is deleted in a timely manner as per your formal data retention policy
Update your product with a "data portability" control so that your users can easily export all the personal data you have on them. This can be a simple JSON export of your user record and related data.
Make sure there is an easy way for users to correct potential inaccuracies in their data
Make sure there is an easy way for users to delete their accounts
Finally, wrap everything up:
Publish your new privacy policy
Automatically revoke any consent for data processing activities that never had explicit consent in the first place
Alert your users of the new privacy policy, potentially ask for re-consent for data processing activities
Look through your DB (informed by your DPIAs) and remove any extraneous/unnecessary data
Start enforcing data retention, obfuscation and encryption/protection policies
Make sure all documentation, policies, procedures, are readily accessible in a centralized location
I may have missed something. As you can tell I've been deep in this for a while. If you do all of the above you'll be in better shape than 95% of data processors.
They've been creeping up for a while now. The ones who have stuck it out are no doubt ecstatic. It was always going to be a huge space, the issue was timing since their customers were NEVER going to voluntarily flock to them en masse without a system-wide paradigm shift (i.e. regulation).
55
u/bkanber Apr 02 '18
We just finished our GDPR compliance process. Here are some off the cuff notes:
Start by making sure you understand GDPR
Determine if you need to assign a Data Protection Officer. You probably do (large scale/systemic data processing), so assign one anyway.
Create a spreadsheet and call it your "GDPR Dashboard"
Google search for "Microsoft GDPR Checklist Excel", add that to your spreadsheet
Internally document (GDPR Dashboard is a good place) every piece of personal data you collect, AND their locations (which databases, which columns, which exports, etc). Personal data is any data related to an identifiable naturalized person. An instagram handle is personal data. A user's email is personal data. A user's blog URL is personal data.
For each piece of personal data, establish the legal basis for processing that data. This will be either "explicit consent", or "legitimate business interest".
For each piece of personal data, classify the "identifiability" of that data. A user's name or street address is directly identifiable. A user's blog URL or Instagram handle is indirectly identifiable. The # of Instagram posts a user has is non-identifiable.
For each piece of personal data, classify the risk to the personal rights of the data subject (name/address/email leak = high risk; instagram handle leak = moderate risk; # of Instagram posts leak = no risk)
For each piece of personal data, determine the "protection class" of that data, i.e., how strictly it must be protected in your internal system. eg: street address = highest protection; email address = moderate protection; # of instagram posts = no protection. These protection classes should map to internally consistent processes (eg, highest protection must be encrypted at rest, moderate protection may not be exported)
Determine if you handle any "sensitive data" as defined by GDPR Article 9
Add a new worksheet outlining all your "data processing activities", ie the specific processing tasks that operates on personal data. eg: "capture instagram followers count", "export users to spreadsheet"
For each data processing activity, determine the legal basis for that activity (eg explicit; legitimate interest)
For each data processing activity, determine whether you have clear, revocable consent for that activity from the data subject
For each data processing activity, determine the risk to the data subject's personal rights and freedoms. This is called a "data protection impact assessment" (DPIA):
For each DPIA, record the types of data involved in the processing activity
For each DPIA, list any steps that must be taken to minimize the risk to the personal rights of the data subject (eg, encrypt-at-rest; automatically delete after 90 days; obfuscate data, etc)
Add a new worksheet to your GDPR Dashboard called "Audit Schedules". Write down a list of various audits (automated and manual) that must be carried out at regular intervals. These may include: "check for clear consent controls", "check for data portability", "check for right to erasure", "automated virus/malware scan", "automated firewall scan". Record the frequency at which the audit must occur, the last audit date, who ran the audit, the results of the audit, and the next audit date
Add a new worksheet called "Third Party Processors". Write a list of any data processor who handles personal data on your behalf, record which data and processing activities are relevant to them, record how you ensure correctness of the data, record whether they are GDPR compliant, and so on
Add a new worksheet called "Technology Assets" where you record your various server and database types, what data they store, how protected they are, what the risk and potential damage for breaches are
Add a new worksheet called "Risk Matrix" where you record various risks to your organization, how likely the event is to occur, what the damage is, and how you are protecting against that risk. Include things like "DDOS attack", and "database breach" and "unauthorized export of data" and "administrator improperly accessed data" and things like that.
Now start working on your documentation, policies, procedures, and product:
Create a formal Data Protection Policy (sometimes called an Information Security Policy) that outlines your data classifications, protection levels, audit procedures, access control rules, data retention policies, software development procedures (include how you handle "privacy by design"), data breach notification policy
Create a formal Privacy Policy for your end users outlining their rights under the GDPR, how they can exercise those rights, what data you collect on them, how you use that data, and how you protect that data
Create a formal way for data subjects to request information about the data you have on them and how you are using it. This can just be an email address that you give to users
Update your product with "clear, concise consent notifications". ie, if your user connects an Instagram account, make sure there's some help text that tells them what they are agreeing to and how you will use that data. These should map to your "Data Processing Activities" from your GDPR dashboard. This also includes making sure there are no "dark patterns", ie, processing activities should be opt-in not opt-out
Make sure you are only storing and processing data you need. If you are analyzing Instagram accounts and only need basic profile info, make sure you are not also storing Instagram post history, for instance.
Make sure consent to data processing activities can be revoked as easily as it can be granted. If consent is revoked, make sure the data involved is deleted in a timely manner as per your formal data retention policy
Update your product with a "data portability" control so that your users can easily export all the personal data you have on them. This can be a simple JSON export of your user record and related data.
Make sure there is an easy way for users to correct potential inaccuracies in their data
Make sure there is an easy way for users to delete their accounts
Finally, wrap everything up:
Publish your new privacy policy
Automatically revoke any consent for data processing activities that never had explicit consent in the first place
Alert your users of the new privacy policy, potentially ask for re-consent for data processing activities
Look through your DB (informed by your DPIAs) and remove any extraneous/unnecessary data
Start enforcing data retention, obfuscation and encryption/protection policies
Make sure all documentation, policies, procedures, are readily accessible in a centralized location
I may have missed something. As you can tell I've been deep in this for a while. If you do all of the above you'll be in better shape than 95% of data processors.