GDPR compliance, a group effort
One of the notable consequences of the entry into force of the General Data Protection Regulation (GDPR) is the power of supervisory authorities to sanction organisations by up to 4% of the group’s turnover. This calls for a global compliance effort, covering every entity within the same group.
Several needs therefore emerge:
- a need for steering by the compliance bodies or control functions within the group
- a need for sharing the directives and good practices relating to the GDPR across the group
- a need for sharing knowledge about the GDPR (which converges with the duty to raise awareness of data protection, also introduced by the GDPR).
A governance model suited to the group
Groups must consequently set up governance for their GDPR compliance programme (or include GDPR-related needs in broader “Compliance” governance). The various projects carried out by Make IT Safe with its clients have brought to light the existence of different governance arrangements for this compliance work.
These include:
- governance models that appoint a group Data Protection Officer (DPO), acting as “lead” over a set of subsidiary DPOs, all tasked with working together on the group’s compliance
- models in which a single entity in charge of compliance sets the guidelines and steers the compliance programme of every entity
- models in which compliance is largely delegated to the group’s various entities.
The type of governance adopted by an organisation depends heavily on its initial structure and on the context in which it operates.
A need for tooling
Alongside the definition of this governance, many groups have identified the need to put a tool in place to support them in their compliance programme. GDPR compliance indeed requires a large number of tasks (mapping of processing activities, building a processor register, setting up procedures to respond to data subjects exercising their rights, and so on), continuous monitoring and greater responsiveness. A good initial organisation is no longer enough to meet these expectations, which in practice makes it necessary to set up a complete steering tool at group level.
A few of the main selection criteria for a GDPR tool can be listed: its features, of course, the way they make compliance work easier, but also keeping compliance up over time. Given the governance issues involved in group compliance, it also seems essential, when selecting a tool, to take into account its ability to support the governance model adopted by the group.
Adaptability and agility required to meet GDPR needs
A tool’s ability to adapt to a governance model will therefore depend in particular on being able to describe the group structure precisely, to segregate compliance work by entity where necessary, to describe the roles of the various compliance actors within the group effectively, and to establish hierarchies between the entities and/or the actors involved in the process.
But the need does not stop there: a group is an organic structure that lives and changes over time. The tool must therefore be able to follow the group as it evolves. New entities emerging, mergers with or integration of external organisations, people moving within the group or changes in responsibilities are all issues the solution must address, by adapting to the changes made within the group.
What makes a good GDPR solution for large groups is not limited to its ability to cover the various articles of the regulation: it also includes the organisational dimension of the group and the tool’s ability to adapt to the governance challenges of a group that is constantly changing.
