Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

5/1/2018
10:30 AM
Jen Brown
Jen Brown
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

A Data Protection Officer's Guide to GDPR 'Privacy by Design'

These five steps can show you how to start building your foundational privacy program for the EU's General Data Protection Regulation.

Part 2 of our DPO's Guide to the GDPR Galaxy series.

Today, we're mapping our GDPR journey and focusing on the key steps to implement the basic building blocks of a "privacy by design" program.

1. Assemble your privacy building blocks. If you don't already have a foundational privacy program, now is the time to roll up your sleeves and start one. While we've been focusing on GDPR, chances are this isn't the only privacy law your organization is subject to, which is why it's critical to set clear goals. The very first goal you should make is creating the privacy vision and mission statement. The intention is to create a clear, concise message to communicate the purpose of the program to all key stakeholders and to circulate it and gain buy-in from your business executives.

2. Define the scope of your privacy program. Once you've established your privacy vision and mission statement, you can begin to determine the program scope. If GDPR is your sole focus, then you would want to find out if you are in scope for GDPR by reviewing the 99 articles that comprise the law. For organizations outside of the European Union, one rule of thumb to follow here is that if you process data that belongs to EU citizens, then your organization falls under GDPR. From there, you must figure out if you are a controller (the natural or legal authority that, either alone or jointly, determines the purposes and means of processing personal data), processor (the natural or legal authority that processes personal data on behalf of the controller), or possibly both.

3. Build your privacy and GDPR army. Start by referencing GDPR Articles 37–39 to determine if you need to appoint a data protection officer (DPO). If after reviewing those articles, your company decides to appoint a DPO, even if not legally required to, you must then adhere to GDPR requirements. If you don't need a DPO, it's a good idea to appoint a privacy champion. Ensure your DPO or privacy champion is empowered to execute on the program vision and mission statement and that this person has the support of the C-suite.

GDPR responsibilities don't solely rest on the shoulders of your DPO or privacy champion, so you'll need to look at all affected areas of your organization. With GDPR, that's probably every department if you have employees in the EU. There are many resources on the internet to help you with this decision if you need a quick gut check.

Begin building support and gathering information from key internal partners such as security, human resources, legal and information technology teams, and any other relevant departments. Work with your partners/stakeholders to help them understand why it's necessary to document how and what type of data flows through each group in order to meet the rigorous records of processing activities requirements in GDPR Article 30.

4. Next stop on your privacy program road map — creating an actual road map! Every program needs a framework to build from and expand over time. Frameworks help provide structure and guidance such as requirements in policy or process. They help reduce risk and show compliance with best practices. Some examples of privacy frameworks to reference and leverage when building your own include, but are not limited to, Privacy by Design, Fair Information Practice Principles (FIPPs), and ISO 29100 Privacy Data Protection Standards.

As you start to work with your internal technical stakeholders, it's imperative they are committed to building privacy into every aspect of the product. Walk them through GDPR Article 25, which focuses on data protection by design and by default, and be sure to include security in the conversation because you can't have privacy without security. Baking those in from the very beginning is an important foundational piece of a solid privacy program and of GDPR. As a best practice (and per GDPR Article 32), the controller and processors must implement appropriate technical and organizational measures to ensure a level of security that is appropriate to the risk.

As a key part of your road map, privacy impact assessments and, when appropriate, data protection impact assessments (DPIAs) must be performed if processing data could result or lead to identity theft, damage to a person's reputation, discrimination, or any other sort of physical, material, or nonmaterial damage. (For more information on DPIAs, see GDPR Article 35.)

5. Establish processes and metrics for accountability and benchmarking. Other elements that are key to a successful privacy and security program include identifying and establishing metrics and instituting a life cycle management process (think software development life cycle but for privacy) to ensure that controls are working as designed and are effective to continue to support and maintain the program. Additionally, there must be measures in place to respond to incidents and events such as breaches, legal holds, and requests for information.

At any point in the process of building or enhancing your program, you may decide to perform a gap assessment against your requirements or hire an independent third party to carry out the assessment. Performing a gap assessment against your privacy framework will highlight the areas that still need addressing. There is nothing wrong with self-assessments; however, using a third party helps demonstrate to customers that the program has been reviewed by independent, impartial parties.

Related Content:

Jen Brown is Sumo Logic's compliance and data protection officer (DPO) and is responsible for leading compliance, risk, and privacy efforts for the company, including GDPR, PCI DSS, ISO 27001, HIPAA, SOC2, and FedRAMP, as well as several other regulations. Prior to Sumo ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
micjustin33
50%
50%
micjustin33,
User Rank: Apprentice
5/22/2018 | 3:45:35 AM
GDPR Compliance Checklist
To effective GDPR compliance, over-viewing the checklist is mandatory. This checklist will help both users and business significantly to understand rules and regulations that come under GDPR to ensure the online data privacy.

Here is the list of GDPR compliance you take care of as part of implication.
Aviation Faces Increasing Cybersecurity Scrutiny
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/22/2019
Microsoft Tops Phishers' Favorite Brands as Facebook Spikes
Kelly Sheridan, Staff Editor, Dark Reading,  8/22/2019
MoviePass Leaves Credit Card Numbers, Personal Data Exposed Online
Kelly Sheridan, Staff Editor, Dark Reading,  8/21/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2016-6154
PUBLISHED: 2019-08-23
The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).
CVE-2019-5594
PUBLISHED: 2019-08-23
An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI.
CVE-2019-6695
PUBLISHED: 2019-08-23
Lack of root file system integrity checking in Fortinet FortiManager VM application images of all versions below 6.2.1 may allow an attacker to implant third-party programs by recreating the image through specific methods.
CVE-2019-12400
PUBLISHED: 2019-08-23
In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this im...
CVE-2019-15092
PUBLISHED: 2019-08-23
The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExpCsv_Exporter class.