The General Data Protection Regulation (GDPR) is one of the most important data protection and personal privacy laws in effect right now. While it’s an EU law, GDPR affects businesses all over the world by introducing new international standards for collecting and storing personal information digitally.
Whether you’re a small business or an enterprise, GDPR is bound to impact how your organization handles data — whether that data belongs to your customers or your employees.
Being unable to comply with GDPR regulations can lead to fines of up to 10 million euros or 2% of your entire global yearly turnover. With a price that steep, understanding and following these new regulations is a priority.
Here at CoreView, we help organizations meet international standards in compliance and security through configuration-as-code. Here’s a step-by-step GDPR guide with all the little details you need to stay compliant:
This article covers:
GDPR stands for General Data Protection Regulation. This set of data privacy laws went into effect in the EU in May 2018. While the regulations are only concerned with protecting the data rights of EU citizens, they actually impact businesses worldwide thanks to the global reach of the internet.
If your organization does business with or employs citizens of the European Union, GDPR applies to you. If you’re in any way responsible for handling or storing data that belongs to EU citizens, you are certain to be impacted by GDPR.
At its core, GDPR is all about implementing better standards for the way personal data is collected, stored, and processed. Sometimes, that’s as simple as making sure that you obtain proper consent from potential customers before sending them any promotional emails. At other times, it can be more complicated as it deals with the way your data storage is structured on a configurational level.
GDPR categorizes data as either personal or sensitive. Personal data is identifiable in nature but doesn’t reveal confidential information about a person, such as names, email addresses, or dates of birth. Sensitive data is more critical in nature as it relates to potentially compromising information about a person’s life, such as credit card numbers or trade union memberships.
There are specific guidelines for processing personal and sensitive data. These guidelines are, in turn, affected by two key considerations — data rights and user consent. Not only do these new regulations establish universal standards for obtaining consent for collecting personal data, but they also impart certain rights upon individuals once they’ve chosen to part with their data.
Some time ago, the EU Publications Office released a four-page PDF detailing seven steps an organization should take to be compliant with GDPR. Here’s a slightly more accessible summary of its contents:
Conduct an internal audit of the data you use throughout your organization. Do you obtain proper consent before collecting this data? How is this data collected and stored? What steps does your organization take to prevent the data from falling into the wrong hands? Is it really necessary for your organization to have this data?
Not only should you obtain proper consent before collecting data on an individual, but you should also strive to inform them about what exactly that data is going to be used for. GDPR imposes strict regulations against the collection of data under false pretenses. You should also be able to hand over the data you collect on an individual should the data subject request it.
Delete unnecessary and outdated data you no longer need, by implementing proper data retention policies within your organization. Also, make it possible for individuals to request deletion of the data you have on them and make sure to comply with such requests on priority.
Secure the personal data you store by using strong encryption technology and enabling privacy best practices like two-factor authentication. For organizations with many employees, proper data access policies are critical to limit the number of personnel involved in handling sensitive data. If your organization stores data on a cloud-based platform like Microsoft 365, familiarize yourself with the security options available and ensure they are configured correctly.
Create proper documentation of your organization’s data processing activities, detailing what data is collected and how it is stored. This is important because you may be asked to turn over this documentation in the event of an investigation.
If your organization uses subcontractors for collecting or storing information, make sure that you’re intimately aware of their data practices so that you aren’t involuntarily implicated in a compliance issue. Ask your subcontractors for details on how they obtain consent before collecting individual data and what security measures they use for storing it.
Data Protection Officers (DPOs) are designated employees responsible for monitoring your organization’s data handling and ensuring compliance with regulations. While smaller organizations might not need a DPO, enterprises that handle large amounts of information should have one.
If your organization uses Microsoft 365 for storing and collecting business data, you can take advantage of its inbuilt features to ensure compliance with GDPR. Since 2018, Microsoft has introduced a number of tools that address various aspects of GDPR compliance.
In 2022, Microsoft announced Microsoft Purview, bringing together all its compliance offerings. Purview is a comprehensive data governance solution covering Microsoft Compliance Manager, Data Loss Prevention (DLP), and more. Here are some key features:
Microsoft Purview is a comprehensive security and compliance solution backed by Microsoft’s security expertise. It helps you manage your data ecosystem in compliance with regulations like the EU GDPR.
However, Microsoft Purview does not address automated configuration management. Without a centralized portal for accessing, managing, securing, and documenting your Microsoft 365 configuration, you don’t have a way of tracking changes to your tenant environments and rolling back to a previous version if necessary.
That’s where CoreView comes in. As a comprehensive configuration management solution for Microsoft 365, CoreView Configuration Manager lets you track and document changes to your tenant configuration that could negatively impact your compliance posture. It also enables you to roll back tenant configuration by creating an automatic backup each time someone implements a new change.
With CoreView Configuration Manager, you have a centralized dashboard to access your tenant configurations and monitor changes that might affect GDPR compliance. CoreView also offers a baseline configuration that you can customize for maximum compliance with regulations like the EU GDPR.
Sound interesting? Why not schedule a free demo today and see how CoreView can improve your compliance posture across Microsoft 365?
