# Getting your records GDPR-ready 
Author:  Pal Sinha, Barnali 
Author URL: https://financedigest.com/author/pal-sinha-barnali
Published: 2016-08-12
Category: NEWS
Category URL: https://financedigest.com/category/news
Meta Title: Prepare your Business for GDPR Compliance in 2018
Meta Description: Learn the key steps to ensure your business is compliant with new regulations around the treatment of personally identifiable information (PII) and the GDPR by
URL: https://financedigest.com/getting-your-records-gdpr-readyhtml

![undefined](https://prod.superblogcdn.com/site_cuid_cm5qst7v3003gwirgwqtxn8i8/images/810-6913-366-1736844583498-compressed.jpg)

_**Gavin Siggers**, Director of Professional Services, Iron Mountain_

A lot can happen in two years. By 2018 we are expected to have witnessed the first human head transplant, Adobe Flash is predicted to be no more, the UK may or may not have left the EU and the flow of data into organisations will have increased by as much as five-fold, according to IDC.

Another significant development due in 2018 is the deadline for meeting new regulations around the treatment of personally identifiable information (PII). When combined with expected volumes in data growth, this could have huge implications for any business which processes personal data.

Earlier this year, the European Parliament [passed the final vote](http://www.europarl.europa.eu/news/en/news-room/20160407IPR21776/Data-protection-reform-Parliament-approves-new-rules-fit-for-the-digital-era) on its new General Data Protection Regulation (GDPR), which is designed to protect personal information in an increasingly digital world.  While the new laws won’t be enforced for another two years, it is a relatively short period of time considering that businesses will need to assess the new requirements, evaluate existing measures and plan a path to full compliance.

To help [businesses understand the impact of the GDPR on their information management](https://www.financedigest.com/intelligent-receivables-management-why-its-a-businesss-greatest-ally.html "Intelligent Receivables Management: Why it’s a business’s greatest ally") processes and where it fits within the wider regulatory landscape, here are six key steps to getting records GDPR-ready.

**What is GDPR?**

Designed to protect personal information in an increasingly [digital world](https://www.financedigest.com/the-digital-first-world-financial-services-predictions-for-2022.html "The digital-first world: financial services predictions for 2022"), the GDPR is by far the largest shake-up of data protection rules so far this century. It includes more than 50 Articles that have far-reaching implications for organisations and their use and [storage of personal data](https://www.financedigest.com/data-storage-market-revenue-is-expected-to-increase-at-a-cagr-of-13-6-during-2021-2025.html "Data Storage Market revenue is expected to increase at a CAGR of 13.6% during 2021-2025"). In essence, the legislation protects the right of a European citizen to determine whether, when, how and to whom his or her personal information is revealed and how it can be used.

The advice of the [Information Commissioners Office](https://ico.org.uk/media/for-organisations/documents/1624219/preparing-for-the-gdpr-12-steps.pdf) is that businesses need to start planning their approach to GDPR compliance as early as they can. The problem is that many businesses [across Europe](https://www.financedigest.com/demand-for-energy-efficient-and-advanced-fairway-mowers-to-be-witnessed-across-europe.html "Demand for Energy-efficient and Advanced Fairway Mowers to Be Witnessed across Europe") remain unaware of how the changes will affect them and the impact they have.

There are a number of [important steps](https://www.financedigest.com/eu-u-s-step-up-russian-aluminium-nickel-imports-since-ukraine-war.html "EU, U.S. step up Russian aluminium, nickel imports since Ukraine war") you can take now to help your organisation can identify where PII resides and understand your obligations towards managing it. With the prospect of multi-million Euro fines for non-compliance, can you afford to wait?

**Step 1 – What is personal data and do I have it?**

_The first step in deciding which parts of the new legislation will apply to your organisationis understanding what is meant by personal data. The definition of ‘personal data’ in the context of the new regulation is data relating to a ‘data subject’ (a person) who can be directly or indirectly identified on the basis of that data. Such data also includes device identifiers, cookies or IP addresses. This means that, under the GDPR, [data controllers within organisations should be aware of all personal data under their control and able to demonstrate that they understand the potential risks](https://www.financedigest.com/omicron-poses-very-high-risk-but-data-on-severity-limited.html "Omicron poses ‘very high’ risk but data on severity limited") to information, as well as how to mitigate those risks._

**Step 2 – Does GDPR apply to me?**

_Next, it is important to have an understanding of the key terminology included in the GDPR in order to know whether it is relevant to your organisation. As well as ‘personal data’, [key terms](https://www.financedigest.com/automotive-navigation-solutions-market-size-and-key-trends-in-terms-of-volume-and-value.html "Automotive Navigation Solutions Market Size and Key Trends in Terms of Volume and Value") to understand include ‘territorial scope’, ‘data subject access requests’, ‘data protection impact assessment (DPIA)’, ‘the right to erasure’, ‘data portability’ and ‘consent’. For further information on these, go to_ [_our knowledge centre_](http://www.ironmountain.com/Knowledge-Center/Reference-Library/View-by-Document-Type/White-Papers-Briefs/I/Importance-and-Status-of-the-General-Data-Protection-Regulation-GDPR.aspx) _, or find the glossary of terms on_ _eugdpr.org_ _._

**Step 3 – Where does data live within my organisation?**

_In order to meet your statutory obligations, you first [need to know](https://www.financedigest.com/ukraine-and-russia-what-you-need-to-know-right-now.html "Ukraine and Russia: What you need to know right now") where personal data lives. A [detailed analysis](https://www.financedigest.com/poly-cotton-fabric-market-detailed-analysis-of-current-and-future-industry-figures-till-2020-2030.html "Poly Cotton Fabric Market Detailed Analysis of Current and Future Industry Figures till 2020-2030") of the data stored on corporate systems, employees’ personal devices, offsite archives and filing cabinets, as well as information stored by suppliers, subcontractors and business partners (people who process personal data on your behalf) will be required to give you the full picture._

**Step 4 – Develop a data map and classify** [every piece of information](https://www.financedigest.com/repository-of-analysis-and-information-for-every-facet-of-the-hydroxymethylbutyrate-hmb-supplement-market-2021-2031.html "Repository of Analysis and Information for Every Facet of the Hydroxymethylbutyrate (HMB) Supplement Market 2021 – 2031")

_Following this analysis, we recommend creating a [data map which provides a 360 degree view of all physical and digital](https://www.financedigest.com/is-the-road-to-data-transformation-slowing-digital-transformation.html "Is the road to data transformation slowing digital transformation?") information, including personal data, stored across an organisation. The data map is an important tool to ensure that you can quickly locate, assess and monitor all information on an ongoing basis._

**Step 5 – Review and update existing policies**

_Once you know where your information is, you need to know what you can do with it and how long you are permitted to keep it. This requires making sure that your retention policies are up to date, reflecting legal, regulatory or contractual obligations so that you are only keeping what you should and that you’re destroying personal data (and all other records) when you are required to in a defensible way._

**Step 6 – Maintain awareness and responsiveness**

_Finally, it is [important to make sure that the business](https://www.financedigest.com/the-importance-of-upskilling-to-prepare-for-business-automation.html "The importance of upskilling to prepare for business automation") as a whole is aware of its obligations. Information passes through the hands of employees, contractors and suppliers, so all parties must understand and comply with the same retention policies. Just as regulations change and impose new obligations on organisations over time, your retention policies should remain dynamic and responsive, adaptable to evolving business and regulatory landscapes._

Organisations [across Europe](https://www.financedigest.com/white-bullets-piracy-demonetising-programmes-drastically-reduce-ad-revenues-to-piracy-websites-across-europe-analysis-finds.html "White Bullet’s piracy demonetising programmes drastically reduce ad revenues to piracy websites across Europe, analysis finds") have long been familiar with the need to ensure that they store personal data according to the latest regulatory requirements. The introduction of the GDPR, however, and associated penalties for non-compliance – which could result in fines of up to 4% of annual [world group](https://www.financedigest.com/soccer-womens-rights-group-calls-on-fifa-to-kick-iran-out-of-world-cup.html "Soccer-Women’s rights group calls on FIFA to kick Iran out of World Cup") turnover or EUR 20 million – means that it has now become critical to get data retention right.

Following these six [steps is the starting point for avoiding the wrath of the regulators](https://www.financedigest.com/uk-regulators-head-of-enforcement-to-step-down-in-2023.html "UK regulator’s head of enforcement to step down in 2023"). Failure to act now will leave you rushing to catch up at a time when a [mistake or oversight may be punishable by law and could cost](https://www.financedigest.com/life-insurance-for-seniors-can-be-a-costly-mistake.html "Life Insurance For Seniors Can Be A Costly Mistake") your organisation dearly


---
This blog is powered by Superblog. Visit https://superblog.ai to know more.
---