Event host Bernard O’Hara, Director, Risk Consulting at KPMG, said the countdown is on for all organisations “regardless of size or complexity” to be “GDPR ready” before the new European Union rules are implemented on May 25th and advised all businesses to carry out a thorough stocktake of how they hold and process data.
He said structures need to be put in place to ensure businesses are fully aware of the data they hold, are able to react to any breach of their data, able to prove they have the systems in place to deal with a breach and also to deal with any request for information from people on their database.
Tony Hughes, Associate Director, Risk Consulting at KPMG, said:
“GDPR is not just a change in legislation but a change in mindset. You need to assess why you hold data and how you hold it because any breach of your security could leave you extremely vulnerable and put your reputation on the line.
“Companies need to have a plan in place as to how to deal with a data breach and make sure communicate that plan is communicated to the regulator if it occurs.”
Gordon Wade, Associate Director, Legal Services at KPMG, said companies will also have to learn to deal with access requests.
“The removal of the buffer increases the chance of spurious requests as individuals attempt to exercise their rights or merely because it is a cheap, effective means of protest against a company. Organisations need to design and implement template response letters, as well as policy and procedures for handling subject response requests.”
Bernard O’Hara, Director, Risk Consulting at KPMG; Tony Hughes, Associate Director, Risk Consulting at KPMG and Michael Daughton, Partner at KPMG
Advertisement
