Bracing for Change Brought Forth by GDPR

The General Data Protection Regulation (GDPR) will come into effect in the European Union in May 2018. Chances are you’ve already seen quite a bit of buzz surrounding GDPR and for good reason - it represents a significant change in how data will be handled around the world.

In the US, the 2017 GDPR Preparedness Pulse Survey conducted by PricewaterhouseCoopers (PwC) polled C-suite executives from large American multinationals and showed that US companies are overwhelmingly aware of, and concerned with, GDPR regulations. Over half of survey respondents cited GDPR as a “top” priority, and 38 percent named it “among” their top priorities. And rightfully so given that fines are applicable to US businesses as well and that the new regulations are relatively complicated and will require significant preparation, not just as an afterthought.

It’s easy to assume that just because your company doesn’t have a physical or significant presence in the EU that the GDPR doesn’t apply, but the text of the regulation makes it clear that any interaction with EU consumer data brings your company under its jurisdiction. If your website simply collects data on EU citizens, your company must comply. In short, GDPR applies to any enterprise in the world that targets the European market in offering goods or services or profiles European citizens.

Related:What Europe’s New Data Protection Law Means for Data Center Operators

But whether you’re a US company or one of the 50 percent of affected organizations worldwide that will be unprepared one year from now, most of the provisions and stipulations boil down to one simple thing: data governance.  And by putting solid data governance practices in place, you’ll be well on your way to compliance.

Join Data Center World Speaker Kenneth Sanford, lead analytics architect for Dataiku, on March 12, 2018 in San Antonio when he discusses the onerous breach notification requirements of GDPR and high penalties for failing to comply. 

For companies in Big Data (or any data for that matter), one of the most daunting things about the GDPR is that organizations have already accumulated massive amounts of data and the regulations apply not just going forward, but retroactively as well. The path toward GDPR compliance for Big Data organizations begins by identifying the five critical challenges:

When it comes to the GDPR, organizations will ultimately need to take stock of where all their data is stored and ensure that it is accessible, but only to those with a business need to access it. Data team leaders (and DPOs if they are required for your organization under the GDPR) should be able to easily understand and audit data sources, who has access to what, and what sources are being used for which projects.

Aligning Teams

The GDPR changes will certainly force any organization not currently fostering collaboration between teams to do so quickly. But it’s not just a matter of increasing communication over email or company chat. There will need to be a certain amount of transparency surrounding data protection that allows a customer service team to field requests without having to ask the data team for an answer every time or the marketing team to understand what the GDPR restrictions are and not inadvertently violate them when completing a customer targeting project. Additionally, data teams working on new projects can communicate back to the legal team responsible for maintenance of the customer consent agreement and can update it accordingly.

Accommodating Data Subject Requests

One of the biggest changes with the GDPR is the rights of data subjects. Under the new legislation, data subjects have the right to:

While it’s impossible to predict how many data subject requests you may receive, it’s critical to be prepared and have an efficient process in place. And it’s not a good idea to wait and develop a process when the first request comes in.

Data Governance

For this challenge, the answer is the same, and if you’ve addressed the previous challenges, you’ve already gotten started: by centralizing all data work into one place, data governance and potential audits are easy. Security can be tightly controlled via the data science platform, eliminating the risk of rogue personal data floating around on employees’ laptops or local spreadsheets.

Adaptability

Change is inevitable, and the reality of data protection and privacy regulations is that they will continue to evolve with emerging new technologies. So for all businesses working on GDPR compliance, it’s important to adopt a flexible solution that will change along with future technologies and regulations. This, of course, means choosing a solution that offers access to cutting-edge data science tools and the best of the open source world so that the business can continue to grow and evolve and not be stagnated by regulatory requirements. But it also means finding a solution to data governance and the other challenges presented by GDPR that evolve with those requirements instead of backing your business into a technological corner. This is especially true for companies dealing with GDPR that are not based in the EU, and even more so for those facing Brexit uncertainties.

These challenges only scratch the surface when it comes to the changes your organization might need to make in order to comply with the new GDPR. Once these central challenges are resolved, your business will be able to move on to addressing some of the smaller procedural changes and organizational adjustments necessary for full GDPR compliance – because there is ultimately a huge amount of information, regulations and details that need to be addressed by any organization who works with any type of data.

Join Data Center World Speaker Kenneth Sanford, lead analytics architect for Dataiku, on March 12, 2018 in San Antonio when he discusses the onerous breach notification requirements of GDPR and high penalties for failing to comply.