Data protection: Steps Organisations can take to ensure compliance
Download as PPTX, PDF•0 likes•156 views
The document outlines data protection steps organizations should take to ensure compliance with privacy laws, emphasizing the importance of safeguarding personal information. Recommended actions include obtaining support from top management, appointing a privacy officer, understanding data compliance requirements, and implementing a comprehensive personal data protection policy. It also highlights the need for ongoing training, monitoring, and auditing to adapt to new data privacy risks and regulations.
![Data is the new Oil. Data is just
like crude. It’s valuable, but if
unrefined it cannot really be used.
– Clive Humby,
We have for the first time an economy
based on
a key resource [Information] that is not
only renewable, but self-generating.
Running out of it is not a problem, but
drowning in it is.](https://image.slidesharecdn.com/dataprotection10stepspresentations-190619164446/85/Data-protection-Steps-Organisations-can-take-to-ensure-compliance-4-320.jpg)
Data protection: Steps Organisations can take to ensure compliance
- 1. 1 DATA PROTECTION STEPS CAN YOUR ORGANISATION TAKE TO ENSURE COMPLIANCE Presented by Rishi Maharaj Executive Director EquiGov Institute
- 2. "It takes 20 years to build a reputation and five minutes to ruin it." -- —Warren Buffett
- 4. Data is the new Oil. Data is just like crude. It’s valuable, but if unrefined it cannot really be used. – Clive Humby, We have for the first time an economy based on a key resource [Information] that is not only renewable, but self-generating. Running out of it is not a problem, but drowning in it is.
- 5. Our personal digital footprint, an ineradicable record of every electronic interaction, just keeps increasing. Your email traffic, internet search history, geotagged images on our smartphone and social media sites, retail purchases, loyalty program transactions, invoice payments, toll road payments and medical records all add to the unique tread that makes up the footprint. People’s day-to-day movements are often so predictable that even anonymised location data can be linked back to identified individuals with relative ease when it is correlated with other outside information. Apparently our movement patterns are so repetitive and predictable that as few as 4 data points that include date and time are enough to identify an individual.
- 9. • Data protection is about safeguarding our fundamental right to privacy, which is enshrined in international and regional laws and conventions. • Data protection is commonly defined as the law designed to protect your personal information, which is collected, processed and stored by “automated” means or intended to be part of a filing system
- 11. UNREASONABLE INTRUSION REASONABLE EXPECTATION OF PRIVACY
- 18. Buy In from the Top Appoint a Point Person or Team KYD Know Your Data Legal Compliance Requirements Analyse Your Risk Policy Process Training and Awareness Monitor Audit 1 2 3 4 5 6 7 9 108
- 19. Appoint a Point Person or Team KYD Know Your Data Compliance Requirements Analyse Your Risk Policy Process 2 3 4 5 6 7 9 1081 Buy in from the Top Training and Awareness Monitor Audit
- 20. Top management should: convey to all staff of their support to cultivate a personal data privacy respectful culture and commitment to the implementation of PMP through staff meetings or internal circulars; appoint a Point Privacy Officer; endorse the programme controls and the whole PMP; allocate adequate resources (including finance and manpower) to implement PMP; actively participate in the assessment and review of PMP; report to the Board on the programme regularly.
- 21. Buy In from the Top KYD Know Your Data Compliance Requirements Analyse Your Risk Policy Process 1 3 4 5 6 7 9 1082 Appoint a Point Person or Team Training and Awareness Monitor Audit
- 22. • Depending on your organization’s size, or on the sort of data it collects/stores, some regulations will require a formal DPO, but even if this is not mandatory, doing so will make creating a solid Data Privacy Strategy much easier. • On more practical terms, having a person in charge of your Data Privacy Efforts will make sure the next steps (creating a data inventory, mapping requirements, analysing risks, creating both policies and procedures, monitoring compliance)
- 23. Buy In from the Top Appoint a Point Person or Team Compliance Requirements Analyse Your Risk Policy Process 1 2 4 5 6 7 9 1083 KYD Know Your Data Training and Awareness Monitor Audit
- 24. • It is not possible to protect that which you do not know. • Once you have the approval for your new Data Privacy Strategy, someone (or even a whole team) should be assigned the task of creating a data inventory. • This should include every piece of information stored or processed by your company, both electronically and/or hard copies. • The idea is understanding what sort of data is
- 25. WHY … is personal data processed? WHOSE … personal data is processed? WHAT … personal data is processed? WHEN … is personal data processed? WHERE … is personal data processed?
- 26. Buy In from the Top Appoint a Point Person or Team KYD Know Your Data Analyse Your Risk Policy Process 1 2 3 5 6 7 9 1084 Legal Compliance Requirements Training and Awareness Monitor Audit
- 27. Now that you know your data, it is time to understand its privacy requirements. Requirements will be dependent on what sort of data your company is storing/processing and your line of business. For example, since May 2018, the General Data Protection Regulation (GDPR) is mandatory for any organization (including the ones located outside of the EU) that offer goods or services to, or monitor the behavior of, EU data subjects.
- 28. Buy In from the Top Appoint a Point Person or Team KYD Know Your Data Legal Compliance Requirements Policy Process 1 2 3 4 6 7 9 1085 Analyse your Risk Training and Awareness Monitor Audit
- 29. • A risk-based approach is your safest bet for making sure every data privacy vulnerability, threat source, and their joint impact is properly understood so it can be adequately treated. • Privacy risk is defined as the “potential loss of control over personal information • Impact assessment is an important part of any PMP to ensure that the privacy policies and practices of organisations are and remain compliant with
- 30. Buy In from the Top Appoint a Point Person or Team KYD Know Your Data Legal Compliance Requirements Analyse Your Risk Process 1 2 3 4 5 7 9 1086 Policy Training and Awareness Monitor Audit
- 31. • The principles in a personal data protection policy sets the tone and provides guidance for the organisation’s treatment of personal data. • Organisations should develop and communicate a personal data protection policy for both its internal stakeholders (e.g. staff) and external parties (e.g. customers). This will provide clarity to internal stakeholders on the responsibilities and processes on handling personal data in their day-to-day work.
- 32. Buy In from the Top Appoint a Point Person or Team KYD Know Your Data Legal Compliance Requirements Analyse Your Risk Policy 1 2 3 4 5 6 9 1087 Process Training and Awareness Monitor Audit
- 33. • Process will help with any day-to-day tasks. • Some common procedures such as the necessary steps for customer consent, retention of records, secure data disposal, international data transfer, and complaints, amongst others. • One way to translate data protection policies to business processes is by adopting a Privacy by Design (PbD) approach in which organisations consider the protection of personal data from the earliest possible design stage of any project, and throughout the project’s operational lifecycle. This can be as simple as putting data protection considerations in the
- 34. • Establish a process for data breach incidents • Personal data breaches can occur due to various reasons such as malicious activity, human error or computer system error. Organisations should develop and implement a personal data breach management process to address breach incidents. The plan may include the following set of activities – C- Containing the breach A – Assessing the risk R – Reporting the incident
- 35. Buy In from the Top Appoint a Point Person or Team KYD Know Your Data Legal Compliance Requirements Analyse Your Risk Policy Process 1 2 3 4 5 6 7 9 108 Training and Awareness Monitor Audit
- 36. • A sound PMP requires all members of an organisation to be aware of, and be ready to act on personal data protection obligations. Organisation should provide employees with up- to-date training and education tailored to specific needs. The organisation should also document its training processes and measure participation and effectiveness. • It is not possible do have significant corporate cultural change without educating every involved party. For instance, while normal employees should at least understand the basic requirements for working with private data, some specialized functions, including IT staff, Security team, Legal, Auditors, and even the Point Person, may require advanced training, especially if they are expected to
- 37. Buy In from the Top Appoint a Point Person or Team KYD Know Your Data Legal Compliance Requirements Analyse Your Risk Policy Process Training and Awareness Audit 1 2 3 4 5 6 7 108 Monitor 9
- 38. • The effectiveness of programme controls should be monitored, periodically audited, and where necessary, revised. Organisations may consider the following factors before determining whether the programme controls should be revised: • What are the latest threats and risks? • Are the programme controls addressing new threats and reflecting the latest complaint or audit findings? • Are new services being offered that involve increased collection, use or disclosure of personal data?
- 39. Buy In from the Top Appoint a Point Person or Team KYD Know Your Data Legal Compliance Requirements Analyse Your Risk Policy Process Training and Awareness Monitor 1 2 3 4 5 6 7 98 10 Audit
- 40. • The aims of Data Protection Audits address the wider aspects of data protection including: • Mechanisms for ensuring that information is obtained and processed fairly, lawfully and on a proper basis • Quality Assurance - ensuring that information is accurate, complete and up-to-date, adequate, relevant and not excessive • Retention - appropriate weeding and deletion of information • Documentation on authorised use of systems, e.g. codes of practice, guidelines etc. • Compliance with individual’s rights, such as subject access
- 41. We are a Boutique Consulting and Training Firm Specialising in Data Protection, Governance & Monitoring and Evaluation.
- 43. • Privacy Impact Risk Assessment and Policy Development Privacy impact assessments, Data Flow Mapping, Policy development and training based on chosen privacy framework, organizational culture and applicable regulations. • FREEDOM OF INFORMATION Advising on formal FOI request, review of current case law and assessment of your current FOI program to ensure that efficiencies are achieved and legislated requirements are being met. • WHISTLE BLOWING Development/review of whistleblowing policy for your organisation, evaluation of current capability and identify any weaknesses, formulation the right strategy to help people speak up before they speak out.