CWIN17 telford gdpr fatigue - ed tucker dpg

GDPR Fatigue?
Ed Tucker - DPG
Telford, September 27th
#CWIN17

Session’s Title | Date
Copyright © 2017 Capgemini and Sogeti. All rights reserved. 2
Me too! The real issue is a proper approach to Data
Protection

Table of Contents – a healthy dose of realism to the debate!
 The view from the customer and the market.
 What it isn't and more importantly what it is!
 What that means for an intelligent organisation.
 What that means for a non-intelligent organisation.
 What should YOU do.

What the customer feels
 Fatigue – the world and his mom, two cousins, three dogs and a chicken are selling
GDPR!
 Confusion – which bit of GDPR 'expertise' is right in amongst this myriad of conflicting
advice!
 Denial – much like breaches, it won’t happen to me!
 Panic – tick tock!
 With the odd one feeling smug because they actually get it!

What the market says
 We can make you compliant!
 Shelfware architects!
 5 minute abs!
 Encryption is what you need!
 Attacks are more sophisticated!
 Look at everyone who has been breached. Are you next!
 FEAR! FINES!
 There's gold in them there hills!

GDPR – What it isn't!
This.....

GDPR – What it is!
The latest regulation aimed at bringing the protection of personal data to the fore! That's
a good thing!
Much like those that have gone before it's about data protection. You'll find a theme in
all these regs.
Ensuring that reasonable measures are in place to protect said data. Ooh that'll be
data protection again!
Applying sense to the data that you collect, store and process and ensuring that
safeguards are in place to ensure that the data is not put at undo risk.
It's about data protection in it's fullest form!

An intelligent organisation will....
 Understand that it is vital to apply business context and empathy to any approach to
data protection, whilst also future proofing it's improvement activities.
 Need to be open and honest with itself if it is truly to understand it’s position in terms of
data protection and GDPR compliance.
 Ask difficult questions of it's own processes and those of it's suppliers.
 Know that it starts with understanding where it is today in order to build a view of, and
more importantly how it gets to, where it wants to be tomorrow.
 Understand that it is about building a defensible position.
 Really know that it will not be compliant in its entirety!

An unintelligent organisation will....
 Run GDPR as an security programme! (HINT – it's a business problem, if you're running
it as a security programme then you're doing it wrong)
 Just buy shiny new next, next, next generation flashing boxes that mitigated even the
most sophisticated attack (caveats are available) and achieve a grand total of nothing.
 Engage consultants that are either fresh out of university (beware the 'expert'), or have
no experience of actually making change in a business environment. Yes, even with
some of the big boys! What do you prefer theory or practice? I know what I would go for.
 Start running project in silos without having taken stock first, nor understood how any
transformation could be leveraged to do this for them. Ooh wow! Imagine embedding
your data protection improvements at the very heart of your transformation.
 The end result with most of these is a lot of ineffective spend and a false sense of
'compliance'. I've seen it many, many, many times!
 Or of course ignore it and hope for the best! :)

What should you do.
 For me it starts with a stock take, or taking stock.
 Recognise you won’t be compliant! Deal with it!
 You need to build a vision of where you are today in terms of data, data protection and
yes read across into regulation. Nobody can do this for you. They can help, but the
biggest input by far is from you.
 Understand that for some things you are just going to have to document and accept a
position. Are you really deleting records from degrading LTOs? I think not!
 Build a pathway to demonstrate improvements in your data protection maturity.
Demonstrable improvements against your established vision of today.
 There is no quick fix here! Sorry, but there isn't.
 If you do need help then you need to look at serious practitioner level intelligence
integrated with software automation. Neither in isolation is truly effective.

FINALLY!
 Don't be swayed by the mass of hysteria! Every business is different.
 Pick your experts wisely. There's bloody loads of them!!!
 Don't just buy without understanding what you need. Consultancy, software, silver
bullets the lot.
 It starts with a stock take! Go from there.
 You'll get things wrong! Fail fast and move on!
 ...and GOOD LUCK!

Why this approach?
Only one of the 19 participants in our European survey
believed his/her company would fully comply by the
deadline
By the end of 2018 over 50% of companies affected by the
GDPR will not be in full compliance with its requirements
How companies manage, secure and share data is fast
becoming the determining factor in profitable customer
relationships
McKinsey – August 2017
Gartner - 3 May 2017
Accenture – late 2016
http://www.mckinsey.com/business-functions/risk/our-insights/tackling-gdpr-compliance-before-time-runs-out
http://www.gartner.com/newsroom/id/3701117
https://www.accenture.com/nl-en/insight-trust-digital-age

A step by step approach to optimized data protection
Motivation /
Objectives
Intelligence
Analyze
Transformation
Data Protection
Ecosystem
ComplianceandTrust
High
Confidence
M1
M2
M3
M4
M5
Scope Intelligence Report
Low
Confidence
Solutions Sustainable
Transparency
Analyze
Transform
Sustain

Risk Mitigation & GovernanceInsight, Analysis & Planning
• Transparency into processes / data / IT
• Extensive documentation of processes and
processing activities
• Information provision for EU subjects
• Evidence for GDPR compliance
• GDPR impact assessment on projects
• Impacts on underlying systems
• Intelligence gathering
• New and upgraded policies and practices
• New and upgraded roles and responsibilities
• New and upgraded controls and audits
• Risk assessment and mitigation
• Issue and incident tracking
Software AG’s Digital Business Platform
Planning and managing the Data Protection transformation

Thank You!
Phone: +44 (0) 7919 027891
et@dpgovernance.com
Ed Tucker
CIO - DPG
Chief Realist
Speaker 1
Photo
@teddybreath

www.softwareag.com
About Software AG
The digital transformation is changing enterprise IT landscapes from inflexible
application silos to modern software platform-driven IT architectures which deliver
the openness, speed and agility needed to enable the digital real-time enterprise.
Software AG offers the first end-to-end Digital Business Platform, based on open
standards, with integration, process management, in-memory data, adaptive
application development, real-time analytics and enterprise architecture management
as core building blocks. The modular platform allows users to develop the next
generation of application systems to build their digital future, today.
With over 45 years of customer-centric innovation, Software AG is ranked as a leader
in many innovative and digital technology categories. Software AG has more than
4,500 employees, is active in 70 countries and had revenues of €872 million in 2016..

CWIN17 telford gdpr fatigue - ed tucker dpg

Recommended

Recommended

More Related Content

More from Capgemini

More from Capgemini (20)

Recently uploaded

Recently uploaded (20)

CWIN17 telford gdpr fatigue - ed tucker dpg

Editor's Notes