Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


10:30 AM
Jen Brown
Jen Brown
Connect Directly
E-Mail vvv

A Data Protection Officer's Guide to GDPR 'Privacy by Design'

These five steps can show you how to start building your foundational privacy program for the EU's General Data Protection Regulation.

Part 2 of our DPO's Guide to the GDPR Galaxy series.

Today, we're mapping our GDPR journey and focusing on the key steps to implement the basic building blocks of a "privacy by design" program.

1. Assemble your privacy building blocks. If you don't already have a foundational privacy program, now is the time to roll up your sleeves and start one. While we've been focusing on GDPR, chances are this isn't the only privacy law your organization is subject to, which is why it's critical to set clear goals. The very first goal you should make is creating the privacy vision and mission statement. The intention is to create a clear, concise message to communicate the purpose of the program to all key stakeholders and to circulate it and gain buy-in from your business executives.

2. Define the scope of your privacy program. Once you've established your privacy vision and mission statement, you can begin to determine the program scope. If GDPR is your sole focus, then you would want to find out if you are in scope for GDPR by reviewing the 99 articles that comprise the law. For organizations outside of the European Union, one rule of thumb to follow here is that if you process data that belongs to EU citizens, then your organization falls under GDPR. From there, you must figure out if you are a controller (the natural or legal authority that, either alone or jointly, determines the purposes and means of processing personal data), processor (the natural or legal authority that processes personal data on behalf of the controller), or possibly both.

3. Build your privacy and GDPR army. Start by referencing GDPR Articles 37–39 to determine if you need to appoint a data protection officer (DPO). If after reviewing those articles, your company decides to appoint a DPO, even if not legally required to, you must then adhere to GDPR requirements. If you don't need a DPO, it's a good idea to appoint a privacy champion. Ensure your DPO or privacy champion is empowered to execute on the program vision and mission statement and that this person has the support of the C-suite.

GDPR responsibilities don't solely rest on the shoulders of your DPO or privacy champion, so you'll need to look at all affected areas of your organization. With GDPR, that's probably every department if you have employees in the EU. There are many resources on the internet to help you with this decision if you need a quick gut check.

Begin building support and gathering information from key internal partners such as security, human resources, legal and information technology teams, and any other relevant departments. Work with your partners/stakeholders to help them understand why it's necessary to document how and what type of data flows through each group in order to meet the rigorous records of processing activities requirements in GDPR Article 30.

4. Next stop on your privacy program road map — creating an actual road map! Every program needs a framework to build from and expand over time. Frameworks help provide structure and guidance such as requirements in policy or process. They help reduce risk and show compliance with best practices. Some examples of privacy frameworks to reference and leverage when building your own include, but are not limited to, Privacy by Design, Fair Information Practice Principles (FIPPs), and ISO 29100 Privacy Data Protection Standards.

As you start to work with your internal technical stakeholders, it's imperative they are committed to building privacy into every aspect of the product. Walk them through GDPR Article 25, which focuses on data protection by design and by default, and be sure to include security in the conversation because you can't have privacy without security. Baking those in from the very beginning is an important foundational piece of a solid privacy program and of GDPR. As a best practice (and per GDPR Article 32), the controller and processors must implement appropriate technical and organizational measures to ensure a level of security that is appropriate to the risk.

As a key part of your road map, privacy impact assessments and, when appropriate, data protection impact assessments (DPIAs) must be performed if processing data could result or lead to identity theft, damage to a person's reputation, discrimination, or any other sort of physical, material, or nonmaterial damage. (For more information on DPIAs, see GDPR Article 35.)

5. Establish processes and metrics for accountability and benchmarking. Other elements that are key to a successful privacy and security program include identifying and establishing metrics and instituting a life cycle management process (think software development life cycle but for privacy) to ensure that controls are working as designed and are effective to continue to support and maintain the program. Additionally, there must be measures in place to respond to incidents and events such as breaches, legal holds, and requests for information.

At any point in the process of building or enhancing your program, you may decide to perform a gap assessment against your requirements or hire an independent third party to carry out the assessment. Performing a gap assessment against your privacy framework will highlight the areas that still need addressing. There is nothing wrong with self-assessments; however, using a third party helps demonstrate to customers that the program has been reviewed by independent, impartial parties.

Related Content:

Jen Brown is Sumo Logic's compliance and data protection officer (DPO) and is responsible for leading compliance, risk, and privacy efforts for the company, including GDPR, PCI DSS, ISO 27001, HIPAA, SOC2, and FedRAMP, as well as several other regulations. Prior to Sumo ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
5/22/2018 | 3:45:35 AM
GDPR Compliance Checklist
To effective GDPR compliance, over-viewing the checklist is mandatory. This checklist will help both users and business significantly to understand rules and regulations that come under GDPR to ensure the online data privacy.

Here is the list of GDPR compliance you take care of as part of implication.
US Formally Attributes SolarWinds Attack to Russian Intelligence Agency
Jai Vijayan, Contributing Writer,  4/15/2021
Dependency Problems Increase for Open Source Components
Robert Lemos, Contributing Writer,  4/14/2021
FBI Operation Remotely Removes Web Shells From Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/14/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-04-20
A vulnerability of Helpcom could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficient authentication validation.
PUBLISHED: 2021-04-20
vscode-restructuredtext before 146.0.0 contains an incorrect access control vulnerability, where a crafted project folder could execute arbitrary binaries via crafted workspace configuration.
PUBLISHED: 2021-04-20
** UNSUPPORTED WHEN ASSIGNED ** The AdTran Personal Phone Manager software is vulnerable to an authenticated stored cross-site scripting (XSS) issues. These issues impact at minimum versions 10.8.1 and below but potentially impact later versions as well since they have not previously been disclosed....
PUBLISHED: 2021-04-20
** UNSUPPORTED WHEN ASSIGNED ** The AdTran Personal Phone Manager software is vulnerable to multiple reflected cross-site scripting (XSS) issues. These issues impact at minimum versions 10.8.1 and below but potentially impact later versions as well since they have not previously been disclosed. Only...
PUBLISHED: 2021-04-20
** UNSUPPORTED WHEN ASSIGNED ** AdTran Personal Phone Manager 10.8.1 software is vulnerable to an issue that allows for exfiltration of data over DNS. This could allow for exposed AdTran Personal Phone Manager web servers to be used as DNS redirectors to tunnel arbitrary data over DNS. NOTE: The aff...