![The Edge Logo The Edge Logo](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt530eb1f4e672eb44/653a71690e92cc040a3e9d6d/Dark_Reading_Logo_TheEdge_0.png?width=700&auto=webp&quality=80&disable=upscale)
Cybersecurity In-Depth: Feature articles on security strategy, latest trends, and people to know.
5 Pieces of GDPR Advice for Teams Without Privacy Compliance Staff
Are you an army of one tasked with compliance and data privacy? Try these tips to get you and your organization in alignment with regulators.
December 18, 2019
![EU GDPR Bits and Bytes in Data Stream EU GDPR Bits and Bytes in Data Stream](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltdf4970e60af8b48a/64f0d2499e40711c9cfcefcb/602x250_data_gdpr.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
"I've got an opportunity for you," your boss chirps in that telling tone. "The board has requested that you singlehandedly ensure we're GDPR-compliant."
Oh, yes, you can!
The task of making sure your organization is in full compliance with the EU's General Data Protection Regulation may seem daunting, but the good news is there are plenty of resources available. This guide is intended to get you started with strategy, tactics, tips, and potential pitfalls to satisfy the requirements of Europe's landmark data privacy legislation.
And if misery loves company, the reality is that lots of other non-privacy people have been tossed into the GDPR pit by their organizations. While it's often someone in IT or information security who gets the honors, it could also be someone in the legal department or possibly an office manager.
"Very few people are qualified, trained, and up to speed on all the different competencies required with GDPR's data privacy requirements," says Omer Tene, VP and chief knowledge officer for the International Association of Privacy Professionals (IAPP). "Lawyers have tech deficiencies and tech people can't understand laws," but a privacy program needs both to make sure compliance, risk mitigation, and data governance all get addressed.
Regardless of who takes on GDPR compliance, that person (let's assume it's you) will need to involve IT personnel tasked with ensuring data privacy – security, storage, data sharing, and other privacy functions spelled out in the legislation. You'll need to work with business unit leaders to understand how the data is acquired, how it gets shared externally, and which third parties have access to an organization's personal data. Regardless of education or training, you'll need to be well-organized and able to navigate all echelons of your company to get answers and documentation.
But the first step in demonstrating compliance with any data privacy law is data mapping (more on this in a minute), IPAA's Tene explains.
"You need to understand what personal data actually is, what's covered and where it resides within an organization, and how it flows through [internal and external] systems," Tene adds. Regardless of whether IT or infosec personnel are leading the GDPR charge, they'll be brought in to handle the data mapping since it's an IT activity, not a legal one. The task is simply too complex – and important – to be left solely to expensive lawyers.
Now let's get started on your GDPR journey.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024