Process
In order to start with the process of being GDPR compliant, there must be a sense of urgency which comes down from the top management.
In order to prioritize any kind of cyber preparedness, there must be the involvement of an executive leadership. Being compliant with the global hygiene standards in relation to data can be considered as a part of that preparedness.
There should be involvement of all stakeholders as IT by itself isn?t well prepared to meet the requirements set by GDPR. A task force needs to be started which would include departments like sales, marketing, operations, finance ? that is, any group with the organization that deals with data collection, analysis or otherwise makes use of the data personal to the customers.
Having a task force would help in better sharing of information that would be fruitful to those who implement technical as well as procedural changes that are needed, so that they would be better prepared in having to deal with their teams if any impact arises.
A risk assessment should be conducted. An organization needs to know what all data it stores as well as processes for the citizens of EU while also understanding the risks that surround it. It should be also kept in mind that risk assessment should outline all sorts of measures to be taken so as to mitigate that particular risk.
One very key aspect of this assessment conducted would be to uncover all kinds of shadow IT which might be involved in the collection and storage of PII. This shadow IT along with all smaller point solutions point out to a much more greater risk in relation to non-compliance which must not by any means ignored.
