Here are some of the main observations I have made over the last few months on GDPR
IT at the core
• IT needs to be the core of the organisation and not in the shadows in regards to GDPR implementation.
• The Digital core needs to have Central Compliance Dashboard for GDPR
• IDC expect that Europe will need 30000 Data protection officers to need the GDPR requirements.
Focus on Data
• Keep Only the data you need in the digital core to keep your GDPR risks low.
• Use data classification toolkits to ensure you know the important, maybe confidential data from the no so important.
• Get to know the data Lineage of your data so you know where the data in top level comes reports comes from and how it is massaged and renamed as it journeys through the layers from the core IT systems.
• Ensure you have one version of the truth when reporting GDPR statistics
• Use rules engines in your enterprise systems to alarm on risk 24/7 if they discover risk to GDPR compliance
• Enable field based archiving in systems such as CRM and content management tools
• Use strong encryption when storing data as this is your “Key Body Armor” in defence of GDPR audits and breaches.
• Remember you only have 72hrs to report issues
• Use containers on mobile devices and BYOD devices to secure corporate data
Using Devops as a Secure Agile Architecture
Warren Buffet says “Cyber Attacks as a bigger threat to mankind than Nuclear Weapons”. Therefore you need to
o “Be Agile” in your development approaches
o Implement Code Scanning and AI to protect against Zero Day Attacks
o Use AI to “Turning Action into Insights”
o Use OWASP guidelines in your Dev approach
Users have a Right to be forgotten and a Right to Know
o Ensure you keep dates for all Opt-In and Consent data.
o Consent is King in defending against GDPR risk
o Heighted compliance is needed for Genomic and Juveniles data
o Be Geo Aware as all European citizens are protected no matter where they live so ensure you are monitoring nationality in your systems