{"id":1455,"date":"2018-04-13T11:35:41","date_gmt":"2018-04-13T15:35:41","guid":{"rendered":"https:\/\/solutionsreview.com\/security-information-event-management\/?p=1455"},"modified":"2018-04-13T11:35:41","modified_gmt":"2018-04-13T15:35:41","slug":"gdpr-compliance-basics-data-privacy-revolution","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/security-information-event-management\/gdpr-compliance-basics-data-privacy-revolution\/","title":{"rendered":"GDPR Compliance: The Basics of a Data Privacy Revolution"},"content":{"rendered":"

\"GDPR<\/p>\n

The General Data Protection Regulation\u2014known to the world as GDPR<\/a>\u2014 goes into effect in the European Union (EU) on May 25. This regulation constitutes a data privacy revolution; it affects any enterprise that collects and stores information on EU citizens <\/span>even if the enterprise is not based in the EU<\/span><\/i>. Failing to meet GDPR compliance<\/a> can result in staggering fines<\/a>: 20 million Euros ($23.5 million in U.S. dollars) or 4% of annual global sales, whatever is greater, for a violation. Attention must be paid.<\/span><\/p>\n

\t\t\t

\"Download<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div>\n

Yet attention to this critical law seems to be in short supply. Only a third of EU enterprises say they are in line with or on their way to GDPR compliance, and only half of affected U.S.enterprises say the same. \u00a0\u00a0<\/span><\/p>\n

What should enterprises do to prepare for GDPR compliance? What are the first steps? <\/span><\/p>\n

Know the Data Your Enterprise Collects<\/b><\/h3>\n

Following GDPR compliance guidelines will your require your enterprise to do a little self-examination; specifically, self-examination on what kinds of data your enterprise collects and how that data is stored. <\/span><\/p>\n

This may seem simple on the surface, but it can be a much more labor-intensive process that it appears. Enterprises of even middling size can have hundreds of applications storing user data, many of which may pass by unnoticed. Thus it is vital to thoroughly examine your enterprise\u2019s IT environment and secure any potentially leaky data storage problems. <\/span><\/p>\n

GDPR compliance mandates also set limitations about how long user data can be stored, so this should be seen as an opportunity to evaluate your data storage policies and outline risk mitigation policies. <\/span><\/p>\n

Finally, it is vital to remember that you are responsible for the data collection and storage practices of your enterprise\u2019s partners and vendors. If they aren\u2019t in compliance, neither are you. This may be a good time to evaluate your contracts, examine what data is leaving your enterprise, and inquire into your partners\u2019 data policies to avoid the heavy price of a compliance failure. <\/span><\/p>\n

Establish a GDPR Compliance Command Chain<\/b><\/h3>\n

Quick! Who\u2019s in charge of GDPR compliance at your enterprise? How will a violation be handled? If a breach occurs, what is the chain of communication within your enterprise? \u00a0<\/span><\/p>\n

If you don\u2019t know the answer immediately, that is a major problem. GDPR compliance requires that an enterprise notifies all affected parties of a breach within 72 hours of discovery. That\u2019s not a lot of time, and can be a real constraint if your interdepartmental communications are confused.<\/span><\/p>\n

GDPR compliance outlines that the data controller, the data processor, and the data protection officer are the roles most responsible for fulfilling the mandates. These jobs often overlap in their duties: <\/span><\/p>\n