Why it’s so important to be prepared for GDPR Compliance Audit?
There will be a variety of fines available, for DPAs to use against
companies that are non-compliant with the GDPR. The exact level of
fines, aside from the highest possible, has yet to be defined. And,
there will be some leeway for DPAs to make decisions on this matter.
There will also be some leeway when it comes to imposing other
sanctions. What the available sanctions will be is also yet to be
defined.
Although DPAs will have some leeway to make decisions, when it comes to imposing sanctions and fines, it’s expected that they will discuss this type of matter with each other. Doing so will help to maintain the level of uniformity that is required, under the GDPR.
The starting point for any company should be awareness of what the GDPR covers. Many global companies do not believe that the GDPR affects them in any way. They may be in for a shock, if they have anything to do with processing the data of people living within the EU. This does not just apply to data which is received directly from the data subject; it can also apply to data received from a third party. Being aware of the GDPR, and what it means for them, is the first step on the way to compliance for any company.
From then it’s a case of auditing current data and practices, and making sure that any data currently held complies with the GDPR. Companies also need to have processes and procedures in place to ensure that ongoing data collection and management complies with what the GDPR stipulates. They also need to monitor, and report on, the management of data, and identify, and mitigate against, risks. Although companies should do everything possible to ensure the security of data, they should also be prepared to report data breaches within 72 hours. All of this needs to be in place by 25 May 2018, in order for companies to avoid potential fines and sanctions, as well as keeping their good reputations intact, so that future revenue does not suffer.
Although DPAs will have some leeway to make decisions, when it comes to imposing sanctions and fines, it’s expected that they will discuss this type of matter with each other. Doing so will help to maintain the level of uniformity that is required, under the GDPR.
The starting point for any company should be awareness of what the GDPR covers. Many global companies do not believe that the GDPR affects them in any way. They may be in for a shock, if they have anything to do with processing the data of people living within the EU. This does not just apply to data which is received directly from the data subject; it can also apply to data received from a third party. Being aware of the GDPR, and what it means for them, is the first step on the way to compliance for any company.
From then it’s a case of auditing current data and practices, and making sure that any data currently held complies with the GDPR. Companies also need to have processes and procedures in place to ensure that ongoing data collection and management complies with what the GDPR stipulates. They also need to monitor, and report on, the management of data, and identify, and mitigate against, risks. Although companies should do everything possible to ensure the security of data, they should also be prepared to report data breaches within 72 hours. All of this needs to be in place by 25 May 2018, in order for companies to avoid potential fines and sanctions, as well as keeping their good reputations intact, so that future revenue does not suffer.
Comments
Post a Comment