Five steps to being GDPR-ready

25 May 2018 is less than six months away. Karen Janssen, CIO at CTM (Corporate Travel Management), has revealed the five steps you need to take now to ensure you are GDPR ready. 

1               Employee engagement

Make sure the people in your organisation who need to know about GDPR understand that the law is changing and the impact it will have on the company. Assign a Data Protection Officer – someone to take responsibility for data protection compliance.

2               Sort your existing data

Consider an information audit to document what personal data you hold, how you hold it, where it came from and who you share it with.

3               Privacy and procedures

Review your current privacy notices. Check your procedures to ensure they cover individuals’ rights. Look at how you seek, obtain and record consent and whether you need to make any changes.

4               Legal basis for processing personal data

Identify your legal basis for carrying it out data processing and document it.

5               Data breaches

Make sure you have the right procedures in place to detect, report and investigate a personal data breach.

This post was written by Karen Janssen, Chief Information Officer at Corporate Travel Management (CTM), a top ten global TMC exhibiting at the Business Travel Show in February. To register for a free visitor pass and meet up with CTM (stand B620) to discuss GDPR and all of your other travel management needs.  

GUEST BLOG: Data – the new gold or the new asbestos?

Hardly a day passes without an article in the press about misuse of personal information, whether that be a hack by bad actors, an organisation losing personal information or someone asserting their right to keep their information private. 

Data privacy is of significant importance in today’s digital economy. The ubiquitous use of personal information in the borderless digital world brings opportunities to organisations and individuals. Organisations benefit from increased efficiency by knowing the users of their services better and tailor marketing offerings to a particular ‘sweet spot’ and individuals have swifter and personalised user experiences.

This is why they say data is the new oil but it is also the new asbestos. I prefer the more positive saying that “data is the new gold and we are the gold miners”. Like the gold miners we can make great use of personal information but we must also collect it in a way that’s not damaging. There are more than 100 data protection laws in place across the world, but this one is certainly the new global trendsetter. 

The GDPR takes full effect on 26 May 2018. It replaces the existing Data Protection Directive at European Union level and the patchwork of data protection legislation in each country at a more local level.  This means harmonisation in Europe through one law across the entire region.  

And what about Brexit? The GDPR will apply to anyone doing business in the EU or more broadly to anyone handling data belonging to EU residents.  This is one piece of law that will avoid the Brexit effect.  To confirm the GDPR’s status in UK law, the government has recently announced it will introduce a law equivalent to the GDPR at a minimum.

The GDPR introduces an accountability based framework for handling personal information.  This new law has some serious teeth.  Failure to comply could result in a fine of up to  €20M or 4% of an organisation’s annual turnover, whichever is greater.

Under the new rules consent must be clear, affirmative and unambiguous.  The pre-filled tick box/opt in is no longer permitted.  Users must be fully informed of how their information is going to be used and why.  This includes knowing the third parties and third countries receiving the information.  The GDPR also requires organisations to notify authorities of a data breach within 72 hours of identification.

This is a lot to deal with isn’t it?  Well yes and no. The GDPR is designed with new technologies and processes in mind. Remember I said data is the new gold and we are the new gold miners?  Data mining/data science initiatives are one of the key drivers for the GDPR.  The same can be said for social media and personalisation through digital tools. The use of data in this way is a growing industry that many organisations are seeking to tap into.  The GDPR has been designed to specifically address the need for data privacy legislation in the digital era, and the GDPR brings some clarity to what many consider a complex topic.

Samantha Simms is global data privacy officer, CWT. She is speaking at Business Travel Summit Amsterdam, which takes place 26-27 September at the RAI. Buyers can attend for free buy registering at http://amsterdam.businesstravel-summit.com/attending/book-your-place