隐私条例

GDPR applies to 所有 companies processing 和 holding personal data of data subjects residing in the EU, 不管公司在哪里. 强制执行日期从5月25日开始, 2018, 和 because GDPR is the most important change in international data privacy regulation in 20 years, 我们想确保你的组织准备好了. 很多你.S. 组织对GDPR如何影响他们有疑问, 特别是关于他们所拥有的个人数据类型, GDPR如何定义个人数据, 以及针对这些个人数据的新保护法律.

LBMC 网络安全 能帮你回答这些问题吗, determine if your organization is a controller or 处理器 under GDPR (或两个), 决定是否需要指派一名资料私隐主任, 和 underst和 how GDPR can impact your organization even outside of the European Union (CCPA).

Our compliance 和 audit experts can help your organization with GDPR compliance in the following ways:

• GDPR适用性分析-LBMC 网络安全 可以帮助您的组织了解GDPR是否适用. 我们将了解你的环境, 您保留个人资料的合法目的, 以及如何与欧盟公民互动. This will involve a review of current data flows 和 interviews with key stakeholders.
• GDPR准备—A readiness assessment takes a deeper dive into how your organization is classified under GDPR. LBMC 网络安全 will assist you in determining if you are a data controller or a data 处理器 和 walk you through determining which legal basis for processing personal data best fits your company. 一旦打下了基础, we can find the impact of GDPR on an organization through underst和ing the current privacy maturity 和 data flows across an organization. We can also help you develop a list of GDPR compliance action items that should be taken, 包括定义您的组织是否是控制者, 处理器, 或两个. 我们将确定关键的利益相关者和数据流, 评估合同义务, 并将GDPR纳入合规计划计划.
• 数据分析与分类—Our team can help your organization define 和 establish a data classification 和 labeling system, as well as review any existing data classification policies to ensure the protection of personal data as defined by GDPR to map out an ongoing compliance strategy. By conducting an inventory of sensitive data types 和 performing an analysis of information 和 inventory of data, we can then help you implement the appropriate controls to ensure GDPR compliance.

您可以实施许多流程来实现GDPR合规性, 但它们都指向一个更大的概念——数据治理.

你可以这样想：

如果您的组织实施的流程是拼图碎片, 数据治理是您寻求指导的框框上的图片. 只有大局才能让所有的小碎片都有意义.

那么,什么 完全 是数据治理吗？?

数据治理 establishes an organization level control environment to govern how data is processed, 使用, 存储, 和保护. 它至少包括以下内容：

• 您的组织处理哪些信息
• 在那里进行处理
• 它是如何处理的
• 确保安全处理的控制措施

如何在组织中实施数据治理?

首先，了解您的组织处理什么类型的信息. 这可能看起来过于简单, but it’s the starting point that will give you the most accurate picture of necessary next steps in your data governance program.

You should accomplish this step using both technical 和 conceptual tactics. 意义, you should conduct a technical analysis in which you analyze 所有 databases 和 information systems to determine or verify the types of information processed.

另外, you should conduct a conceptual analysis in which you lay out business processes to determine 什么 information is processed, 以及在业务过程中信息会发生什么变化.

在这个过程中你需要完成两件事：

1. 将信息分类.

如果你的目标是GDPR合规, 你需要特别关注“个人数据”,” which the GDPR defines as “any information relating to an identified or identifiable natural person (‘data subject’)”.

然而, 对于其他框架, 您还需要担心机密或私人数据, 所以一定要分类 所有 系统中的信息.

2. 创建数据映射.

除了知道 什么 你处理的信息类型，你也会想要记录 当 和 在哪里 这些信息被处理.

The goal is to create a high-level depiction of the storage 和 processing of 所有 data.

这在称呼时特别有用 第三十五条, which requires performance of a data protection impact assessment (DPIA) 当 processing “is likely to result in a high risk to the rights 和 freedoms of natural persons.”

The DPIA requires “a systematic description” of processing as well as an assessment of the necessity 和 risks of those operations, 包括降低风险的措施. Underst和ing 什么 data you’re processing 和 how it flows through your organization will give you a head start on this requirement.

在你了解“大局”之后, 在哪里, 以及你的组织如何处理信息, you’ll need to make sure you have the appropriate control environment in place to manage that information. Your data classifications will help drive the rigor of the controls established to protect the data. 数据保护是GDPR的要求之一.

GDPR还对以下方面进行了严格的规定 国际数据传输. Creating a data map to see 在哪里 personal data is transferred will 所有ow you to underst和 the safeguards currently in place 和 the controls you may need to implement moving forward.

另外, 您需要建立策略, 程序, 以及解决个人隐私权的基础设施.

例如, GDPR第15条 所有ows users to request copies of their personal information or have that information deleted entirely. 你有基础设施来方便地访问这些信息吗? 另外, do you have 程序 in place to define how that information is to be gathered 和 transferred to the requester?

最后，你需要 培训人员 在政策和程序中用于指导适当的数据管理. Although you may be able to implement the correct documentation 和 infrastructure to assist GDPR compliance, 如果员工不知道如何使用这些结构, 他们变得无关紧要.

The goal of data governance is to gain control of your data—to underst和 完全 在哪里 it is, 如何使用, 以及维护其安全的机制. It provides a big-picture compliance strategy that accomplishes the little details of data management.

GDPR即将出台, 虽然数据治理可以帮助您了解实现合规性的途径, 它仍然是压倒性的. LBMC’s GDPR compliance services can help you analyze 和 classify your data as well as provide action items to prepare you for compliance. 联系 us to learn how we can help you develop a GDPR-compliant control environment.