The General Data Protection Regulation (GDPR) is one of the most important data protection and personal privacy laws in effect right now. While it’s an EU law, GDPR affects businesses all over the world by introducing entirely new international standards for collecting and storing personal information digitally.
Whether you’re a small business, an enterprise, or a managed services provider, GDPR is bound to impact how your organization handles data — whether that data belongs to your customers or your employees.
Being unable to comply with GDPR regulations can lead to fines of up to 10 million euros or 2% of your entire global yearly turnover. With a price that steep, understanding and following these new regulations are a priority.
Here at CoreView, we help organizations meet international standards in compliance and security through configuration-as-code. Here’s everything we know about GDPR, along with a step-by-step guide with all the little details you need to stay compliant in 2022:
This article covers:
GDPR stands for General Data Protection Regulation. It’s a relatively new set of laws that went into effect in the EU in May 2018. While the regulations are only concerned with protecting the data rights of EU citizens, they actually impact businesses worldwide thanks to the global reach of the internet.
If your organization does business with or employs citizens of the European Union, GDPR applies to you. As a matter of fact, if you’re in any way responsible for handling or storing data that belongs to EU citizens, you are certain to be impacted by GDPR.
But what is GDPR? At its core, it’s all about implementing better standards for the way personal data is collected, stored, and processed. Sometimes, that’s as simple as making sure that you obtain proper consent from potential customers before sending them any promotional emails. At other times, it can be more complicated as it deals with the way your data storage is structured on a configurational level.
GDPR categorizes data as either personal or sensitive. Personal data is identifiable in nature but doesn’t reveal confidential information about a person, such as names, email addresses, or dates of birth. Sensitive data is more critical in nature as it relates to potentially compromising information about a person’s life, such as credit card numbers or trade union memberships.
There are specific guidelines for processing personal and sensitive data. These guidelines are, in turn, affected by two key considerations — data rights and user consent. Not only do these new regulations establish universal standards for obtaining consent for collecting personal data, but they also impart certain rights upon individuals once they’ve chosen to part with their data.
Quite a little while ago, the EU Publications Office released a 4-page PDF that detailed 7 steps an organization should take to be compliant with GDPR. The document went into great detail about the principles of good data protection for small businesses and enterprise organizations. Here’s a slightly more accessible summary of its contents:
As a first step towards GDPR compliance, conduct an internal audit of the data you use throughout your organization. Do you obtain proper consent before collecting this data? How is this data collected and stored? What steps does your organization take to prevent the data from falling into the wrong hands? Is it really necessary for your organization to have this data?
Not only should you obtain proper consent before collecting data on an individual, but you should also strive to inform them about what exactly that data is going to be used for. GDPR imposes strict regulations against the collection of data under false pretenses, so it’s important to keep your data subjects informed. You should also be able to hand over the data you collect on an individual should the data subject request it.
There’s no point in holding on to unnecessary and outdated data you no longer need. Delete the data when it ceases to be relevant by implementing proper data retention policies within your organization. Also, make it possible for individuals to request deletion of the data you have on them and make sure to comply with such requests on priority.
Secure the personal data you store on your business servers by using strong encryption technology and enabling privacy best practices like two-factor authentication. For organizations with a large number of employees, it’s also important to have proper data access policies to limit the number of personnel involved in handling sensitive data. If your organization stores data on a cloud-based platform like Microsoft 365, try to familiarize yourself with the security options available on the platform and make sure to have them configured correctly.
Create proper documentation of your organization’s data processing activities, with details on what data is collected and how it is stored. This is important because you may be asked to turn over this documentation in the event of an investigation.
If your organization uses subcontractors for collecting or storing information, make sure that you’re intimately aware of their data practices so that you aren’t involuntarily implicated in a compliance issue. Ask your subcontractors for details on how they obtain consent before collecting individual data and what security measures they use for storing it, for example.
Data Protection Officers (DPOs) are designated employees responsible for keeping an eye on your organization’s data handling and ensuring compliance with regulations at all times. While smaller organizations might not need to employ a designated DPO, enterprises that handle large amounts of information should definitely have one.
If your organization uses Microsoft 365 for storing and collecting business data, you can take advantage of its inbuilt features to ensure compliance with GDPR. Since 2018, Microsoft has serially introduced a number of tools that tackle various aspects of GDPR compliance.
In 2022, Microsoft announced that it’s bringing together all its compliance offerings under the umbrella of a new tool called Microsoft Purview. Purview is a one-stop data governance solution for all your compliance needs, which includes new and improved versions of erstwhile offerings like Microsoft Compliance Manager and Data Loss Prevention (DLP). Here's a quick overview of everything Microsoft Purview can do for your organization:
Microsoft Purview is a one-stop security and compliance solution backed by Microsoft’s entourage of over 3,500 security experts and $1 billion in annual cybersecurity investments. It lets you seamlessly manage your data ecosystem to ensure maximum compliance with regulations like the EU GDPR.
However, as a data governance solution, there’s one crucial aspect that’s completely lacking from Microsoft Purview. That’s automated configuration management.
Without a centralized portal for accessing, managing, securing, and documenting your Microsoft 365 configuration, you don’t have a way of tracking changes to your tenant environments and rolling back to a previous version of your tenants in case things ever go south.
That’s where CoreView comes in. As a comprehensive configuration management solution for Microsoft 365, CoreView Configuration Manager lets you track and document changes to your tenant configuration that can negatively impact your compliance posture. It also enables you to roll back your tenant configuration by creating an automatic backup each time someone implements a new change.
With CoreView Configuration Manager, you have a centralized dashboard for accessing your tenant configurations and monitoring changes to your tenants to see if they affect your compliance with GDPR. We even offer a baseline configuration that you can customize for maximum compliance with regulations like the EU GDPR.
Sound interesting? Why not sign up for a free demo today and see how CoreView can improve your compliance posture across Microsoft 365?
