Best Practices to Create a Data Inventory and Meet GDPR Compliance

Best Practices to Create a Data Inventory & Meet GDPR Compliance January 24, 2017

Privacy Insight Series - truste.com/insightseries v

v

© TRUSTe Inc., 2017 1

© TRUSTe Inc., 2017

Today’s Speakers RAY EVERETT Principal Consultant (US), TRUSTe

VERONIKA TONRY President, Privacy Know How, former Global Privacy Manager at Chevron and Applied Materials

GUY SEREFF Corporate Counsel, Level 3 Communications

Privacy Insight Series - truste.com/insightseries v

2 © TRUSTe Inc., 2017

Today’s Agenda

•Welcome & Introductions •Getting Started

•Executing •Next Steps •Q&A

Privacy Insight Series - truste.com/insightseries v

3 © TRUSTe Inc., 2017

Getting Started Scoping, Resourcing, Organizational Buy-In

Guy Sereff, Corporate Counsel, Level 3 Communications

Privacy Insight Series - truste.com/insightseries v

v

© TRUSTe Inc., 2017 4

© TRUSTe Inc., 2017

Scoping the Data Inventory Project •

Determine the organization’s objectives – Compliance with specific frameworks?

– Developing a new Privacy Program?

– Refreshing an existing Privacy Program?

• Identify logical business units

Privacy Insight Series - truste.com/insightseries v

5 © TRUSTe Inc., 2017

Resourcing the Data Inventory Project • Identify roles and responsibilities BEFORE any work begins – Project Manager – Business Unit Leads – Subject Matter Experts

• Set realistic expectations for the level of effort required to complete the project

Privacy Insight Series - truste.com/insightseries v

6 © TRUSTe Inc., 2017

Organizational Buy-In • Data Inventories can be used throughout the organization – Legal and regulatory compliance – Identification of application and storage redundancies – Guide for developing information security framework – Introduction or reinforcement of Privacy by Design concept for application lifecycles – Identification of new data types and uses

• Compliance with GDPR is going to be difficult without a current Data Inventory – Privacy Impact Assessment requirements – Demonstrable compliance – Required data processing registries

– Compliance requirements for wholly automated decision making – Data subject rights Privacy Insight Series - truste.com/insightseries v

7 © TRUSTe Inc., 2017

Execution Discovery, Documentation, and Analysis Veronika Tonry, President, Privacy Know How

Privacy Insight Series - truste.com/insightseries v

v

© TRUSTe Inc., 2017 8

© TRUSTe Inc., 2017

The key to a successful GDPR implementation

Privacy Insight Series - truste.com/insightseries v

9 © TRUSTe Inc., 2017

Best Practices • Adapt the discovery to your company culture • Intake Process – – – –

Do your homework before you interview the organization Be clear around expectations and define the terminology Have examples of processes ready Develop a methodology to execute efficiently

• Document to identify risks and make decisions – Identify high risk processing and evaluate impact – Classify your data: Individual information elements + combined data sets – Develop action plans from the analysis and findings

Privacy Insight Series - truste.com/insightseries v

10 © TRUSTe Inc., 2017

Next Steps Turn Findings into Action, Keeping a “Living” Inventory Ray Everett, Principal Consultant, TRUSTe

Privacy Insight Series - truste.com/insightseries v

v

© TRUSTe Inc., 2017 11

© TRUSTe Inc., 2017

Translating the Data Inventory into Action • Inventory should point to many action items – High risk data elements – Data repositories that need monitoring, controls, policies – Access and External Transfers that need monitoring, controls, policies – Vendors/Partners requiring contractual language, reviews/audits, controls

• Maps should point to processes that need regular scrutiny – Gaps in controls, policies – Processes that need new/periodic PIAs

– Maps should identify vendors who need periodic audits

• Inventory and Maps should also – Support the case for resourcing

– Identify your Privacy Committee members Privacy Insight Series - truste.com/insightseries v

12 © TRUSTe Inc., 2017

“Map Your Team, Team Up on Mapping” • “Institutionalize” your Map with a Privacy Committee – People ignore documents, they can’t (always) ignore a recurring meeting  – Privacy Committee agenda driven by action items, PIA reviews and Data Inventory updates

• Inventory Drives Initial & Recurring Actions – Define and build support for action items – Review progress and results with the Privacy Committee

• Integrate Data Map updates into PIA for products/services/vendors – “Bottom-up” updates – Changes to flows may ripple across organization in unexpected ways

• Define a Cadence for Review/Refreshment – “Top-down” updates – Keep all stakeholders informed of strategic changes, impacts to their business units

Privacy Insight Series - truste.com/insightseries v

13 © TRUSTe Inc., 2017

Questions?

Privacy Insight Series - truste.com/insightseries v

v

© TRUSTe Inc., 2017 14

© TRUSTe Inc., 2017

Contacts For more information on Data Inventory examples, schedule a consultation: https://www.truste.com/business-products/privacy-consulting/data-inventoryand-classification/contact-us/

Ray Everett Veronika Tonry Guy Sereff

reverett@truste.com veronika@privacyknowhow.com guy.sereff@level3.com

Privacy Insight Series - truste.com/insightseries v

v

Š TRUSTe Inc., 2017 15

Š TRUSTe Inc., 2017

Thank You! Register now for the next webinar in our 2017 Winter/Spring Webinar Series on February 23 “Privacy Shield Self-Certification– What’s Next?”

See http://www.truste.com/insightseries for the 2017 Privacy Insight Series and past webinar recordings.

Privacy Insight Series - truste.com/insightseries v

v

© TRUSTe Inc., 2017 16

© TRUSTe Inc., 2017