GDPR How to get started?
Download as PPTX, PDF2 likes301 views
The General Data Protection Regulation (GDPR) is an EU law effective May 25, 2018, establishing stringent data privacy standards for companies handling EU citizens' personal data, regardless of their location. It introduces significant challenges for organizations, such as the right to be forgotten and requirements for data protection by design and by default. Organizations are encouraged to start preparing for compliance by reviewing their data governance policies and implementing necessary controls to protect personal data.
GDPR How to get started?
- 2. Slide 2 12/3/2017GDPR is a transformative new data privacy law in the EU The General Data Protection Regulation (GDPR) is a new law in the European Union (EU) providing for uniform data protection regulation throughout the EU. When it goes into effect on May 25, 2018, it will represent one of the highest standards of privacy and data protection in the world and will provide EU Data Protection Authorities (DPAs) the ability to regulate and bring enforcement against companies across the globe. It will replace the existing EU Data Protection Directive, which came into effect almost 20 years ago in 1998. 2018 2012 - 2015 2016 - 2017
- 3. Slide 3 12/3/2017 0% 5% 10% 15% 20% 25% 30% 35% We do not think we will be audited in 2018 We really do not know where to start Not relevant (the GDPR does not affect our organization) Don't know We are awaiting further guidelines It is largely ready already because we are compliant with the current data protection regulation There is a solid plan in place to ensure readiness by May 2018 We will start addressing it this year (2017) To what extent is your organization preparing for the General Data Protection Regulation (GDPR) to take effect? Question: Source: IDC's 01-2017 Benelux CIO Survey (n = 182)
- 4. Slide 4 12/3/2017European Data protection law with focus on Personal data • GDPR applies to every company that collects personal data from EU data subjects, regardless of where the company is established • It applies to data processors as well as data controllers • It applies to companies that offer goods or services in the EU, regardless of whether payment is required, or monitor the behavior of EU residents • It broadens the term Personal Data – “any information that directly or indirectly can be related to an identified or identifiable natural person” • It may impact other region operations if EU products and business processes can not be easily carved out or EU data is transferred to/used in the other regions. Major impact to the collection and/or processing of: Consumer Data Employee Data Business Customer Data
- 5. Slide 5 12/3/2017 Which of the General Data Protection Regulation (GDPR) requirements will pose the greatest challenge to your organization? 0% 10% 20% 30% 40% 50% Appointing a data protection officer Data portability (the need to provide data in machine-readable formats upon request) Data transfers to countries outside of the EU To service a person's data access request Defining data use cases and managing consent Data minimization principle (collecting only the least amount of data necessary) Data breach notification within 72 hours Encryption and/or pseudonymization of data Defining what "state of the art" means for our organization in terms of processes and technologies Data protection by design and by default Right to be forgotten (RTBF)/right to erasure Source: IDC's 01-2017 Benelux CIO Survey (n = 182) Question:
- 6. Slide 6 12/3/2017GDPR sets a high bar for personal privacy protection of digital data, which poses considerable challenges for organizations. The high privacy standards set by GDPR poses plenty of challenges to organizations, ranging from process and technology challenges to organizational and cultural challenges. CIO’s have provided their rankings of GDPR-related challenges: • Right to be forgotten (RTBF). Unsurprisingly, RTBF poses the biggest challenge of all GDPR requirements. Organizations don't really understand the data they have amassed over the years, and they wonder how they will be able to identify all the data relating to one individual, let alone delete all copies of this data. Balancing RTBF with contradicting regulatory demands for data retention adds an additional layer of complexity. • Data protection by design and by default. Organizations will need to document that they have considered data protection from the onset for all products, services, campaigns, analytics initiatives, and so on. Documentation of meetings and decision-making processes will be key to fulfilling this requirement. • "State of the art." The future-proofing aspect of GDPR keeps organizations on their toes to regularly review process and technology best practices for privacy protection. • Encryption and pseudonymization of data. GDPR adds complexity to every Big Data and analytics project. Striking a balance between getting maximum value from analytics and not violating privacy will be the key to business success. Surprisingly, managing consent ranks much lower. IDC believes managing consent is a core activity for organizations. • Data breach notification within 72 hours. This requires technologies to detect data breaches in time as well as to notify the data protection authority and the public (otherwise, reporters or the media will do the informing for you, with bad implications for your company's reputation).
- 8. Slide 8 12/3/2017 Protecting customer privacy with GDPR What does GDPR mean for your company data?
- 9. Slide 9 12/3/2017GDPR capability model IDENTIFY Personal Data MANAGE Personal Data PREVENT Privacy Violations DETECT & RESPOND Data Breach Handling
- 11. Slide 11 12/3/2017 Given how much work may be involved in preparing, you should not wait until they begin enforcing the regulations in May 2018. You need to begin reviewing your privacy and data governance policies and procedures now. Many organizations also take this opportunity to review their data strategy and modernize infrastructure. We recommend you begin your journey to compliance with the GDPR by focusing on four key steps: {{ Protecting customer privacy with GDPR Identify what personal data you have and where it resides Discover Govern how personal data is used and accessed Manage Establish security controls to prevent, detect and respond to vulnerabilities & data breaches Protect Keep required documentation, manage data requests & breach notifications Report ① ② ③④ How do you get started with GDPR compliance?
- 12. Slide 12 12/3/2017 • Integrate search for applications to locate personal data across user- defined indexes • Trace and identify personal data stored in different data sources Search & identify personal data Protect dataControl access Detect & Remediate threats Classify data Record- keeping • Securely manage access to your data, applications and other resources • Enforce separation of duties • Determine and assign relative values to your data • Employ advanced encryption, cryptography, and monitoring • Restore data availability with a variety of recovery and redundant storage options • Proactively prevent, detect and respond quickly to threats • Deliver verifiable transparency and delivers tamper-resistant insights with activity log • Leverage comprehensive compliance and privacy documentation. Discover Manage Protect Report 4- Step approach to become GDPR compliant ① ② ③ ④
- 13. Slide 13 12/3/20174- Step approach Identify what personal data you have and where it residesDiscover1 Govern how personal data is used and accessedManage2 Establish security controls to PREVENT, DETECT, and RESPOND to vulnerabilities & data breaches Protect3 Keep required documentation, manage data requests and breach notificationsReport4
- 15. Slide 15 12/3/2017 Identify what personal data you have and where it residesDiscover1 Govern how personal data is used and accessedManage2 Establish security controls to PREVENT, DETECT, and RESPOND to vulnerabilities & data breaches Protect3 Keep required documentation, manage data requests and breach notificationsReport4 4- Step approach
- 16. Slide 16 12/3/2017 Data governance: Data classification: Manage2
- 17. Slide 17 12/3/2017 Identify what personal data you have and where it residesDiscover1 Govern how personal data is used and accessedManage2 Establish security controls to PREVENT, DETECT, and RESPOND to vulnerabilities & data breaches Protect3 Keep required documentation, manage data requests and breach notificationsReport4 4- Step approach
- 18. Slide 18 12/3/2017 Protect3 Preventing data attacks: Detecting & responding:
- 19. Slide 19 12/3/2017 PROTECT Across all endpoints, from sensors to the datacenter DETECT Using targeted signals, behavioral monitoring and machine learning RESPOND Closing the gap between discovery and action Identify what personal data you have and where it residesDiscover1 Govern how personal data is used and accessedManage2 Establish security controls to PREVENT, DETECT, and RESPOND to vulnerabilities & data breaches Protect3 Keep required documentation, manage data requests and breach notificationsReport4 4- Step approach
- 20. Slide 20 12/3/2017 IDENTIFY PROTECT DETECT RESPOND RECOVER Cybersecurity Context Framework Maturity level of your organization (Based on NIST framework) DEFENCE IN DEPTH Multiple Layers 99,9% TTD TTI / TTR Across all endpoints, from sensors to the datacenter Using targeted signals, behavioral monitoring & machine learning Closing the gap between discovery and action
- 21. Slide 21 12/3/2017 Identify what personal data you have and where it residesDiscover1 Govern how personal data is used and accessedManage2 Establish security controls to PREVENT, DETECT, and RESPOND to vulnerabilities & data breaches Protect3 Keep required documentation, manage data requests and breach notificationsReport4 4- Step approach
- 22. Slide 22 12/3/2017 Record-keeping: Reporting tools: Report4
- 23. Slide 23 12/3/2017 DEVICE Protection Device health verification Device Integrity Device control Security Policies Mobile Device Management & Mobile App management to protect corporate apps and data on any device THREAT Resistance Report phishing & malware websites Firewall (Network attacks) Anti-Malware (Emerging & New/Unknown) Zero-day threat & malware protection thru email filtering IDENTITY Protection Identity Validation (Natural biometric) or familiar (PIN) Isolate HW user’s secrets (Pass-the-hash) Single-sign-On Privileged Identity Management (Account Lockdown) INFORMATION Protection Volume Drive Encryption Information Protection Data Loss Prevention Enhanced customer data access controls Identity high-risk/abnormal usage Intelligent classification, labeling & encryption to secure corporate files & emails Breach DETECTION Investigation & RESPONS Conditional access Behavior based, post-breach advanced attack detection/investigation/resp onse to sophisticated threats Detect known malicious attacks, uncover abnormal activity, Identify Security issues and risks SLA TTD TTI/TTR Pre-Breach Post-Breach Security Capabilities Protect your Identity & Data
- 24. Slide 24 12/3/2017 Compliance Manager helps assess and track data protection and compliance posture and get actionable insights to improve. With an intelligent score, customers can better understand their compliance posture against regulatory standards. Data Catalog/Register will help discover data across your applications, tools and databases. Information Rights Management helps protect data across its lifecycle by preventing sensitive information from being printed, forwarded, saved, edited, or copied by unauthorized individuals. Discover Manage Protect Report DPA Compliance Program provides access to compliance documentation and security experts and auditors Existing compliance approaches and attestations already in alignment with the GDPR provide a good foundation to start from. Identity and Access Management and Conditional Access can help manage access to data across platforms, whether in the cloud, on premise or in a hybrid environment. Security Capabilities
Editor's Notes
- #3: In April 2016, the European Union Member States approved a transformative new data protection and privacy regulation that will replace the existing EU Data Protection Directive that has been in place for the past 20 years. The Directive was not a law but rather a baseline set of requirements whereby each EU Member State had to pass into law its own law/regulation that governed organizations that processed personal data in their respective regions. The GDPR is a single, uniform law that seeks to harmonize data protection and privacy laws across all EU Member States while providing greater regulatory reach, which I’ll speak to in a moment. Companies were provided a two-year implantation timeline to prepare for the May 25, 2018 implementation date, which we’ve outlined on the slide here.
- #5: One of the biggest and most impactful changes of the GDPR is the extraterritorial regulatory oversight and enforcement reach that it gives the EU regulators – under the existing Directive, the EU regulators have had limited authority to regulate and bring enforcement against companies that weren’t headquartered in their member states or didn’t physically process data in their countries; With the GDPR, they will have the authority to regulate and bring enforcement actions against any company that handles personal data (employee/consumer/business contact) of EU residents regardless of where that company is headquartered or where the data is processed. Additionally, companies that are classified as data processors (i.e., service providers) are now directly liable and in-scope for the regulation whereas they were previously only covered from a contractual compliance standpoint. This impacts a of TMT companies, like cloud providers.
- #9: 8