Automating the Monitoring & Management of GDPR Compliance By Paul O’Brien 6th March 2019

Introduction Experienced Risk & Compliance Professionals Members of IRM, IOB, ACOI, ACCA, ISI... Involved in the Development of Standards We supply a Governance, Risk & Compliance Software Solution called CalQRisk CalQRisk is used by 170+ regulated firms Including Brokers, Financial Advisors, Fund Management Companies, Fund Administrators, Credit Unions, Solicitors, Hotels, Charities and Local Authorities

Agenda Introduction What to monitor Case Study Automating the Management of GDPR Effective and Meaningful Monitoring Using the inputs to improve the outcomes

What to monitor and how often? Compliance with internal policies and procedures Use of personal data Imparting of information Data retention and deletion Response to Data Subject requests Facilitating DS exercise of rights Does every Process have an owner?

Why Monitor?

Case Study A Large Hotel Chain 75 entities world wide Different National Cultures Standardisation of Processes Confirmation of Application of Corporate Standard Processes Daily / Weekly / Monthly / Quarterly / Annually Supported by appropriate Audit

Automate the Risk Assessment Process

Typical Monitoring Question Set

Automate the Input Gathering Risk assessments Incident and near-miss reports Complaints Data subject requests Audit findings Breach reports Etc.

Data Subject Requests

Use the Inputs to Improve the Outcomes Monitoring makes the vulnerabilities apparent Prioritise issues and concentrate resources where they are most needed Find common control weaknesses and redesign process to get better results Modify the monitoring frequency in response to the input

Make Monitoring Easy and Meaningful Leadership needs confirmation that the procedures are being followed by all those responsible all the time Those responsible, need to be able to attest to the effectiveness of the processes Only ask monitoring questions that are meaningful If the monitoring tells you the process is not working – Change the Process

Monitor Compliance

Thank You pobrien@calqrisk.com