EU-GDPR - threat or chance?

Be prepared, be positive and be creative

1. Be prepared that GDPR's impact expands beyond the EU – all companies processing personal data of data subjects "in the Union" will be affected and more countries are expected to follow the EU's efforts

2. Take a positive approach towards GDPR understanding the GDPR as an opportunity to maximize consumer trust and data value - not just as a threat to your organization

3. Be creative when it comes to consent generation – GDPR’s stricter rules are not the end of data monetization but require innovative solutions to make consent easy and smooth for customers

    

Focus on six key business capabilities

To prepare organizations for the upcoming regulation, the regulatory framework can be broken down into six key business capabilities.

1. Clearly define personal data governance
   Companies need to develop a framework for the management of internal access and processing rights. Since most breaches come from within the company, it is crucial to properly manage employees’ access to sensitive data and restrict processing of such data to the necessary minimum. Another governance requirement is the appointment of a data protection officer (DPO), as key responsible for all data protection matters within a company.

2. Identify sensitive data
   Organizations have to identify the GDPR-relevant data they process and implement systems to categorize and identify personal data within the organization. This is also key for the efficient execution of the data subject rights.

3. Use creative storage solutions to increase data protection
   Organizations need to implement data storage solutions that enhance the protection of personal data. They should adhere to the principle “Privacy by Design” by installing the necessary technology and taking organizational measures to mitigate risks (unlawful destruction, accidental loss, alteration or unauthorized disclosure of data).

4. State-of-the-art data protection and breach notification system
   Companies will need to develop security systems to protect personal data and to detect data breaches. GDPR also tightens the breach notification responsibilities, as the data protection authorities need to be notified about safety breaches within 72 hours.

5. Consent generation and consent management system
   Companies need to implement a system for the generation, storage and management of GDPR-compliant consent. Consent generation should involve all online and offline communication channels, like the company website, email, messengers or even direct mailing and in-store approaches.

6. Data processing documentation and risk assessment
   Organizations need to implement processes for the constant documentation of data processing activities and risk assessment of new processing activities.

    

Understanding GDPR as an opportunity

Lastly, organizations need to understand GDPR as an opportunity, not necessarily only as a threat. The GDPR gives organisations the chance to redefine the way they use and process personal data, at best by putting their customers in the middle of their re-engineering efforts.

In the matrix below you can see how the previously mentioned capabilities open up opportunities to increase trust and transparency, how they can increase the value of data, as well as how they can help optimizing marketing and customer targeting.

GDPR also presents an opportunity for companies to partner with small, versatile tech start-ups. New data protection obligations require advanced and innovative solutions. When partnering with start-ups, established companies can benefit from the execution speed and focus that distinguishes start-ups from other GDPR offerings in the market. The new requirements for consent generation, for example, make it difficult for companies to ask their customers for their consent to process their personal data via the channels they used to in the past. New and creative solutions are needed, which is exactly where start-ups come into play, as they can offer targeted solutions for this one aspect of GDPR that are innovative and can be rapidly deployed in any organization.

Use the European General Data Protection Regulation as a chance: in the short program "Data Science" you can learn how to prepare your company for the upcoming regulation. Get more information here.