A Data Protection Officer's Guide to GDPR 'Privacy by Design'

Part 2 of our DPO's Guide to the GDPR Galaxy series.

Today, we're mapping our GDPR journey and focusing on the key steps to implement the basic building blocks of a "privacy by design" program.

1. Assemble your privacy building blocks. If you don't already have a foundational privacy program, now is the time to roll up your sleeves and start one. While we've been focusing on GDPR, chances are this isn't the only privacy law your organization is subject to, which is why it's critical to set clear goals. The very first goal you should make is creating the privacy vision and mission statement. The intention is to create a clear, concise message to communicate the purpose of the program to all key stakeholders and to circulate it and gain buy-in from your business executives.

2. Define the scope of your privacy program. Once you've established your privacy vision and mission statement, you can begin to determine the program scope. If GDPR is your sole focus, then you would want to find out if you are in scope for GDPR by reviewing the 99 articles that comprise the law. For organizations outside of the European Union, one rule of thumb to follow here is that if you process data that belongs to EU citizens, then your organization falls under GDPR. From there, you must figure out if you are a controller (the natural or legal authority that, either alone or jointly, determines the purposes and means of processing personal data), processor (the natural or legal authority that processes personal data on behalf of the controller), or possibly both.

3. Build your privacy and GDPR army. Start by referencing GDPR Articles 37–39 to determine if you need to appoint a data protection officer (DPO). If after reviewing those articles, your company decides to appoint a DPO, even if not legally required to, you must then adhere to GDPR requirements. If you don't need a DPO, it's a good idea to appoint a privacy champion. Ensure your DPO or privacy champion is empowered to execute on the program vision and mission statement and that this person has the support of the C-suite.

GDPR responsibilities don't solely rest on the shoulders of your DPO or privacy champion, so you'll need to look at all affected areas of your organization. With GDPR, that's probably every department if you have employees in the EU. There are many resources on the internet to help you with this decision if you need a quick gut check.

Begin building support and gathering information from key internal partners such as security, human resources, legal and information technology teams, and any other relevant departments. Work with your partners/stakeholders to help them understand why it's necessary to document how and what type of data flows through each group in order to meet the rigorous records of processing activities requirements in GDPR Article 30.

4. Next stop on your privacy program road map — creating an actual road map! Every program needs a framework to build from and expand over time. Frameworks help provide structure and guidance such as requirements in policy or process. They help reduce risk and show compliance with best practices. Some examples of privacy frameworks to reference and leverage when building your own include, but are not limited to, Privacy by Design, Fair Information Practice Principles (FIPPs), and ISO 29100 Privacy Data Protection Standards.

As you start to work with your internal technical stakeholders, it's imperative they are committed to building privacy into every aspect of the product. Walk them through GDPR Article 25, which focuses on data protection by design and by default, and be sure to include security in the conversation because you can't have privacy without security. Baking those in from the very beginning is an important foundational piece of a solid privacy program and of GDPR. As a best practice (and per GDPR Article 32), the controller and processors must implement appropriate technical and organizational measures to ensure a level of security that is appropriate to the risk.

As a key part of your road map, privacy impact assessments and, when appropriate, data protection impact assessments (DPIAs) must be performed if processing data could result or lead to identity theft, damage to a person's reputation, discrimination, or any other sort of physical, material, or nonmaterial damage. (For more information on DPIAs, see GDPR Article 35.)

5. Establish processes and metrics for accountability and benchmarking. Other elements that are key to a successful privacy and security program include identifying and establishing metrics and instituting a life cycle management process (think software development life cycle but for privacy) to ensure that controls are working as designed and are effective to continue to support and maintain the program. Additionally, there must be measures in place to respond to incidents and events such as breaches, legal holds, and requests for information.

At any point in the process of building or enhancing your program, you may decide to perform a gap assessment against your requirements or hire an independent third party to carry out the assessment. Performing a gap assessment against your privacy framework will highlight the areas that still need addressing. There is nothing wrong with self-assessments; however, using a third party helps demonstrate to customers that the program has been reviewed by independent, impartial parties.

Related Content: