The average time for a business to become fully compliant with the new EU General Data Protection Regulations ( EU GDPR) is 9 months

With so many things to consider to become fully compliant before May 2018, where is your business in the compliance process and what are the risks associated with getting it wrong?

Request a call back

Step one – Understand the GDPR legal framework

The first step to ensuring compliance is to understand the legislation in place, as well as the implications of not meeting the required standards, by doing a compliance audit against the GDPR legal framework. Part of this compliance audit, no matter the size of the company, is hiring a data protection officer to explain the regulations and apply them to the business. It’s preferable that this person has a combined legal and technology background so they understand both the regulatory framework and the technical specifications needed to meet this. As each organisation is unique, the road to GDPR compliance will be different as well. Correct guidance from leaders within the business needs to be adapted to this.

Step two – create a Data Register

Once businesses have a clearer idea of their readiness to meet the regulatory requirements, they need to keep a record of the process. This should be done through the keeping of a Data Register – essentially a GDPR diary. Each country has a Data Protection Association (DPA), who will be responsible for enforcing GDPR. It is this organisation that will judge whether a business has been compliant when determining any potential penalties for being breached. Should a breach occur during the early stage of implementation, the business should be able to show the DPA it's progress towards compliance through its Data Register.>See also: General Data Protection Regulation: the BC/DR impact Without any proof that the company has even started the process, the DPA could enforce a fine between 2% and 4% of a company’s turnover, depending on the sensitivity of the data being breached. The nature of the data, could make up the DPA’s mind to move to fine the company much quicker, as well.

Step three – classify your data

This step is all about understanding what data businesses need to protect and how that is being done. Businesses must firstly find any Personal Identifiable Information (PII) – information that can directly or indirectly identify somebody – of EU citizens. It’s important to identify where it is stored, who has access to it, who it is being shared with etc. They can then determine which data is more vital to protect, based on its classification. This also means knowing who is responsible for controlling and processing the data, and making sure all the correct contracts are in place.

Step four – Start with your top priority

Once the data has been identified, it’s important to start evaluating the data, including how it’s being produced and protected. With any data or application, the first priority should be to protect the user’s privacy. When looking at the most private data or applications, businesses should always ask if they really need that information and why. This data is always of most value to a hacker and hence has the highest risk of being breached.Businesses should complete a Privacy Impact Assessment (PIA) and Data Protection Impact Assessment (DPIA) of all security policies, evaluating data life cycles from origination to destruction points. It’s important to remember when doing this, of the rights of EU citizens, including data portability and restriction of processing. The “right to be forgotten” is one to consider as part of GDPR. This is data third parties can use to identify someone must be deleted if requested and approved by the EU. It’s vital this data is correctly destroyed and can’t be accessed.>See also: Change is coming: the GDPR stormFrom here, companies should evaluate their data protection strategies – how exactly they are protecting the data (for example, with encryption, tokenisation or psuedonymisation). This must focus on the data they are producing, data which has been backed up – either on-site or on the cloud – and historical data that can be used for analytical purposes. Businesses must ask themselves how they are anonymising this data to protect the privacy and identification of the citizens it relates to. Always keep in mind that data should be protected from the day it is collected, through to the day it is no longer needed and then it should be destroyed in the correct manner.

Step five – assess and document additional risks and processes

Aside from the most sensitive data, the next stage is to assess and document other risks, with the goal of finding out where the business might be vulnerable during other processes.As this is being done, it is vital businesses keep a roadmap document to show the DPA how and when they are going to address these outstanding risks. It’s these actions that show the DPA that the business is taking compliance and data protection seriously.

Step six – revise and repeat

The last step is all about revising the outcome of the previous steps and remediating any potential fall out, amending and updating where necessary. Once this is complete, businesses must determine their next priorities and repeat the process from step four.Security needs to be at the forefront of every new idea, plan and application for businesses moving forward. From next year, companies will no longer have the luxury of hiding any breaches. Those that fail to show they have the right measures in place – or at least making efforts to – will face fines and undoubtedly a big hit to their reputation. In a year’s time, regulators will start to get the real picture of how seriously businesses are taking the security of their data – and the number of breaches really taking place.

Top 4 reasons why preparing for the EU GDPR IS NOW, not next year

With the average time of 9 months to compliance, businesses can’t afford to waste any more time to avoid significant fines

With data providers and brokers already working hard to ensure data is EU GDPR compliant, data costs will soon soar and become too expensive and therefore negatively effecting your outbound sales and marketing strategy


As more and more businesses decide to eventually ensure their data is compliant, prospects and customers will become increasingly annoyed and unresponsive due to being overcome with the repeated question, ‘can I have your permission please to “Opt In” to send you ’ – with the most likely being no

‘Opt in’ data can make your outbound sales and marketing strategy significantly more effective. How much wasted time working duplicate, incomplete and inaccurate data could be eliminated and how many more sales could be achieved?


Prospect Connect are assisting businesses to prepare for the new regulations, providing a team of data processors who work to ensure your customer and prospecting data is fully compliant in 6 simple steps. The clock is ticking - are you prepared?

Request a call back