Is Your Company Ready for the General Data Protection Regulation?

Remember the Y2K bug, the computer coding flaw that was predicted to cause global havoc when the two-digit dates embedded in software rolled over from 1999 to 2000? After organizations around the world spent a year checking and upgrading their systems to deal with the issue, few major problems ended up occurring.

The world is now on the brink of what could be called the Y2K bug of data privacy - the European Union's General Data Protection Regulation (GDPR), tough rules that require companies to be more transparent about the information they collect on individuals and how it is used.

GDPR's impact reaches beyond Europe because it covers any company with data about European Union citizens on its servers. Are you a U.S. bank with a subsidiary in Europe or a retailer with online customers on the continent? GDPR applies to you.

GDPR replaces the 1990s-era Data Protection Directive 95/46/EC and institutes new obligations on matters such as data use consent, data anonymization, breach notification, trans-border data transfers and appointment of data protection officers.

It covers any information that can be used to directly or indirectly identify a person - a name, a photo, an email address, financial details, posts on social networking sites, medical information or a computer IP address.

The EU Parliament approved GDPR after four years of debate in April 2016, but the big Y2K-like date on the horizon is May 25, 2018. That's when GDPR becomes enforceable with fines of up to 4 percent of a company's annual worldwide revenue or €20 million, whichever is greater.

Organizations can adopt one of two strategies in reaction to GDPR: Hope that the regulation is all bark and no bite and the EU really won't enforce it. Or expect that the EU will take the law very seriously and undertake the work now to address it.

Option #2 is the only sensible one, of course, so companies need to spend the next year making major operational moves to be prepared.

The task is immense. Many organizations have grown their customer databases through disparate, siloed systems, then have tried to integrate them through a higgledy-piggledy mess of connections. Tracking an individual across this convoluted landscape is very complicated.

By empowering individuals to know what data businesses have on them, ask that the data be deleted if they so choose, and demand proof that it has been removed, the regulation forces companies to do a better job understanding and controlling the data they have in their systems if they are to abide by GDPR.

What should organizations do? As with any major challenge, it comes down to a proactive approach and having the right people, processes and technology.

People
Every organization should appoint a senior-level officer who can serve as a central authority on the range of activities, from process reviews to technology purchases, needed to ensure GDPR compliance. This "GDPR czar" should organize activities across the organization and break down any silos that interfere with a coordinated response.

The GDPR leader should be someone other than the Chief Data Officer, a position that 50 percent of companies now have, according to Gartner, and "bears responsibility for the firm's enterprise wide data and information strategy, governance, control, policy development and effective exploitation."

While responsibility for GDPR would seem to fit the CDO's job description, it's important for the CDO to stay focused on leveraging data as a business asset through machine learning, data analysis and other cutting-edge techniques rather than being consumed by the day-to-day intricacies of the GDPR compliance effort.

In addition, GDPR should be considered a board-level imperative. Corporate boards should demand accountability from the CEO on GDPR and engage in an ongoing dialogue with him or her on the issue.

Process
Organizations should adopt a GDPR operational plan for each of the affected lines of business, including HR, Legal, Marketing, Finance, IT and Procurement. Each department needs to have a firm grasp on what data it has and to update it when necessary.

The GDPR Awareness Coalition, a non-profit initiative established in February 2017 to raise awareness of the regulation, recommends that organizations also ask themselves these questions: Do we have appropriate means to secure and protect data? Do we have measures in place to ensure we don't hold data longer than is necessary? Is our system of storing data suitable for responding fully to requests to, say, delete an individual's information without delay?

GDPR is not an area to skimp on carefully thought out and wel-executed processes.

Technology
Without question, organizations will need to acquire additional technology to come to grips with GDPR. Among the types of technologies that will be required are encryption technologies, analytic and reporting technologies, and test data management.

While this additional spending may be a bitter pill for some companies to swallow, the fact is, an ounce of prevention is worth a pound of cure. Investing in technology now is better than throwing away money on stiff fines later.

As with the Y2K bug, organizations cannot adopt a wait-and-see approach. They need to diligently work now to address the regulation as the May 25, 2018, deadline looms.

Tick tock, tick tock.