This is part of Solutions Review’s Premium Content Series, a collection of contributed columns written by industry experts in maturing software categories. In this submission, Dufrain CEO Joseph George offers three keys to meeting GDPR requirements through strong record-keeping and innovative software tools.
For IT firms and any other groups who plan to trade in Europe, keeping up with GDPR is essential to conducting compliant business.
However, four years have passed since the deadline for firms to update their processes in line with GDPR, and while some companies implemented procedures to meet the requirements, many are yet to develop processes to properly manage and store unstructured data.
Managing the regulatory risks of this is essential. Any unstructured data containing Personal Identifiable Information (PII) must be classified appropriately, with relevant access controls applied to it and key attributes documented. With that in mind, let’s dig into the measures IT firms can take to ensure their business sticks to the right side of regulation.
GDPR Requirements
Understanding the Risks of Holding Personal Data
IT firms must first understand the financial and reputational risks involved in the handling of PII. If an unchecked data silo is exposed and reported to the ICO, the potential penalty could have a serious impact on an organization’s future. Fines can be high enough to undermine businesses – in these cases, a penalty will be equal to 4 percent of worldwide turnover or up to £20m, whichever is higher.
But it’s not just the impact of a fine that needs to be considered. Customers must feel confident that a business or service provider will handle personal data safely and correctly. It only takes one mistake to damage this trust, and once non-compliance has been made public, it will be a long battle to rebuild relationships. Severe non-compliance, repeat offending or a single large-scale offense can leave companies with no other option than to close entirely.
The Impact of Siloed data
Data silos are unwanted for a variety of reasons. They can reduce data flow across an organization, slashing productivity, stretching timelines for deliverables, and increasing costs. Why is this? Because when the same data is stored in multiple different locations, the storage, maintenance, and backup costs multiply in kind.
If business areas cannot access all the data they need to perform a task, it’s likely that different departments will create their own versions of the data. As a result, a company will suddenly find itself in possession of multiple versions of the truth that will require careful reconciliation. It’s wasted time, effort, and money – all of which could have been spent on developing new products.
Worse still, if a company cannot effectively track its data, it will also become doubly difficult to keep the data in step with ever-changing regulatory requirements.
Data Governance and Unstructured Data Challenges
Data governance may sound like a complicated matter, but boiled down to its simplest definition, it’s about understanding data as a business asset. Like any asset, data must be carefully managed.
Granted, not all unstructured data is key to the management and provision of quality services and products. Compliant firms must ensure that each business area completes and maintains an Information Asset Register (IAR) – this means that all key unstructured data, inputs, and outputs are documented and understood. When something goes wrong, an up-to-date IAR is a company’s first line of defense.
An IAR contains several types of information, such as the document type, its usage, and whether it contains personally identifiable information. It is crucial that local data management procedures are adopted to review the information held in IARs on a regular basis. For example, if a data file passes its agreed retention period, the data holder must delete that data as soon as possible.
Software solutions are also key. Dynamic and tailored software can seamlessly integrate into a firm’s APIs, identifying data siloes and bringing all unstructured data back under control.
As with all worthwhile data governance strategies, knowledge is key. Firms must know their data. Documenting unstructured data is key to the success of that. This starts with improving data governance – which is only made possible by software solutions that can detect unstructured data.
If firms follow these rules and implement the right solutions, they can follow regulatory requirements and avoid major crises, both reputational and financial.
Joseph George
Joseph is responsible for achieving Dufrain’s vision and ambitions through day-to-day management, direction, growth and development of all functions of the business and leading the consulting team across all locations. Joseph has extensive experience in technology consulting and in delivering business-led regulatory, change and transformation projects as well.
