This website uses cookies. View our cookie policy
Close
United Kingdom
Select regional store:

The key steps to GDPR compliance

 

The General Data Protection Regulation (GDPR) demands greater accountability and transparency from organisations about how they collect, process and store personal information.

Some obligations can be resolved quickly and easily. Others, particularly in large or complex organisations, could have significant budgetary, IT, personnel, governance and communications implications and could require a great deal of work or specific expertise. Ensuring buy-in from senior management and key stakeholders is critical to meeting your obligations.

The ability to prove compliance is critical, and a comprehensive and effective privacy compliance framework will develop evidence to support your compliance claims.


The key steps to GDPR compliance

This checklist highlights the essential steps you need to take to prepare for the GDPR and demonstrate compliance.
 

1. Establish an accountability and governance framework

To do

  • Brief management on the GDPR risks and benefits.
  • Gain management support for a GDPR compliance project.
  • Assign a director with accountability for the GDPR.
  • Incorporate data protection risk into the corporate risk management and internal control framework.

 

We recommend:

 

EU GDPR – A Pocket Guide

This concise guide is essential reading for anyone wanting an overview of the GDPR and the new compliance obligations for handling personal data.

Learn more and buy >>

 

2. Scope and plan your project

To do

  • Appoint and train a project manager, and appoint a DPO if necessary.
  • Identify which entities will be in scope: business units, territories, jurisdictions.
  • Identify other standards or managements systems that could provide a framework for compliance, e.g. implementing ISO 27001 demonstrates information security best practice.
  • Assess the principle of data protection by design and by default against current or new processes and systems.
  • Consider Brexit implications in your planning.

 

We recommend:

 

EU GDPR – An Implementation and Compliance Guide

This bestselling guide details the requirements of the Regulation and provides comprehensive guidance and practical advice on implementing a compliance framework.

Learn more and buy >>

 

Certified EU GDPR Foundation and Practitioner Combination Course

Gain knowledge of the GDPR, and a practical understanding of the methods and tools for implementing and managing an effective compliance framework.

Learn more and buy >>

 

3. Conduct a data inventory and data flow audit

To do

  • Assess the categories of data held, where it comes from and the lawful basis for your processing.
  • Map data flows into, within and from your organisation.
  • Use the data map to identify the risks in your data processing activities and whether a data protection impact assessment (DPIA) is needed.

 

We recommend:

 

Data Flow Mapping Tool and Compliance Manager

This Cloud-based software simplifies the process of creating data flow maps, giving you a thorough understanding of what personal data your organisation processes. Integration with Compliance Manager allows you to track your compliance with the GDPR articles.

Learn more and buy >>

 

GDPR data flow audit

Receive, through an onsite audit, an inventory of the types of personal data collected and processed in your organisation, and a data flow map.

Learn more and buy >>

 

4. Conduct a detailed gap analysis

To do

  • Audit your current compliance position against the requirements of the GDPR.
  • Identify compliance gaps requiring remediation.

 

We recommend:

 

EU GDPR Compliance Gap Assessment Tool

This questionnaire-driven tool helps you to make an assessment of your organisation’s compliance position and identify the gaps for remediation.

Learn more and buy >>

 

GDPR Gap Analysis

Get an onsite assessment of your organisation’s privacy management and data protection practices, and a report summarising compliance gaps and remediation recommendations.

Learn more and buy >>

 

5. Develop operational policies, procedures and processes

To do

  • Create Article 30 documentation – the record of personal data processing activities drawn from the data flow audit and gap analysis.
  • Bring data protection policies and privacy notices in line with the GDPR.
  • Where relying on consent, ensure quality of consent meets new requirements.
  • Review and update employee, customer and supplier contracts.
  • Plan how to recognise and handle data access requests and provide responses within a month.
  • Have in place a process for determining whether a DPIA is required.
  • Secure personal data through appropriate procedural and technical measures.
  • Ensure policies and procedures are in place to detect, report and investigate a personal data breach.
  • Review whether the mechanisms for data transfers outside the EU are compliant.

 

We recommend:

 

EU GDPR Documentation Toolkit

A complete set of easy-to-use and customisable documentation templates, worksheets and policies to document compliance with the GDPR.

Learn more and buy >>

 

DPIA Workshop

This one-day workshop covers when to conduct a DPIA under the GDPR, and uses a real-life case study to demonstrate best practices and methodologies, including the application of a DPIA tool to help assess and address privacy risks.

Learn more and buy >>

 

Cyber Essentials

Cyber Essentials is a world-leading, cost-effective assurance mechanism for companies to demonstrate their use of important basic cyber security controls.

Learn more and buy >>

 

Incident Response Management Foundation Training Course

Find out how to effective manage and respond to a disruptive incident and take appropriate steps to limit the damage of potential information security.

Learn more and buy >>

 

6. Communications

To do:

  • A GDPR is a business change project – effective internal communications with stakeholders and staff is key.
  • Employees need to understand the importance of data protection and be trained on the basic principles of the GDPR and the procedures being implemented for compliance.

 

We recommend:

 

GDPR Staff Awareness e-learning Course

This simple-to-use interactive modular e-learning programme for employees introduces the GDPR and the key compliance obligations for organisations.

Learn more and buy >>

 

Customised GDPR pocket guides and books

Educate your staff on GDPR requirements with our bestselling books, branded with your company logo and a bespoke foreword, or customised to your company branding guidelines.

Learn more and buy >>

 

Monitor and audit compliance

To do

  • Schedule regular audits of data processing activities and security controls.
  • Keep records of personal data processing up to date.
  • Undertake DPIAs where required.

 


Download our free GDPR resources

 

GDPR
green paper

Download

GDPR
infographic

Download

GDPR documentation
templates

Download

GDPR
webinars

Download

 

2017 GDPR
survey report

Download

Speak to an advisor

Please contact our GDPR team for advice and guidance on our products and services.