Privacy

EU General Data Protection Regulation 2016/679 “GDPR”

Effective May of 2018, GDPR Compliance requires system capabilities to manage citizen privacy; to understand how “sensitive” information comes in, moves around, leaks out. Without enhanced privacy technology integration most businesses won’t be able to “transfer” personal data to:

People don’t trust businesses with their private data

While 15% of EU citizens report not trusting businesses with their information, they also lack the tools to securely manage their own private information.

The data problem is enormous

Issues: Data expiration, Duplicate documents, Documents that no longer serve a business purpose. Most documents exist beyond their legal retention and in many cases, no one knows who owns them.

A breach is a breach – (Common and Not Common Principles)

Aren’t most of us already covered with SOC2 or PCI? 

For example, Trust Services Principles and Criteria P6.7 The entity provides notification of breaches and incidents to affected data subjects, regulators, and others consistent with the entity's privacy commitments and system requirements.​

For example, PCI DSS V3.2.1 12.10 Implement an incident response plan… responding immediately to a system breach.​

For example, 47 out 50 States (US) have Breach Notification laws

General Data Protection Regulation (EU) 2016/679

Article 33 (of 99): “Notification of a personal data breach to the supervisory authority - In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay…”