1. Interview with: Joao Torres
Barreiro, Associate VP & Chief Data
Protection Officer, HCL Technolo-
gies
Joao is a keynote speaker at the
marcus evans European Corporate
Counsel Summit 2015 taking place at
Cascais, Portugal, 23 - 24 November.
What do organisations need to
know about the changes the EU
General Data Protection Regulation
will bring?
This regulation will change the power
dynamics between companies, data
protection authorities and data subjects,
which are the customers. It will also
radically transform the way organisa-
tions process personal data and use this
data to do their business. ‘Privacy by
design’ and ‘privacy by default’ will
become the standard.
Instead of looking at those changes as a
challenge, I prefer to face them as an
opportunity. For example until now,
companies had to deal with twenty-
eight European data protection laws. In
the future, they will only deal with one
data protection law in the European
Union.
We cannot dismiss what this data
protection reform will do for economic
growth. In one of the European
Commission’s press releases it was
stated that the benefit of having one
data protection law in the EU, instead of
an inconsistent patchwork of twenty-
eight national laws, is estimated at 2.3
billion Euros per year. Also, strengthen-
ing Europe’s standards of data
protection can be a business opportu-
nity.
What are the key elements for
designing a privacy and data
protection programme?
The key and most important element for
designing a successful privacy and data
protection programme is to first define
the scope of the program. To do
that, companies need to identify what
legal and regulatory data protection
requirements are applicable to their
organisation. This is particularly difficult
for multinational companies, since they
are present in different geographies
across the globe and need to take into
consideration multiple data protection
laws. As well, multinational organisa-
tions need to consider that different
countries may have different views on
the concept of privacy. For instance, the
way an American perceives privacy is
completely different from the way a
European does.
Companies should develop a global
privacy strategy that speaks to all
markets. They can only do this by
adopting a holistic approach with very
high privacy standards that should be
customised only when strictly required.
Why do all departments need to be
engaged when designing a
programme?
There are many functions that do not
have a seat on the privacy office but are
necessary to implement a privacy and
data protection program. For example,
how can the privacy office draft a
procedure that defines how personal
data of employees is processed without
the involvement of the human resources
department? Or how can the privacy
office implement procedures that
address data protection breaches
without the participation of the chief
information security officer and the
cyber security officer?
Also, by engaging several departments
within an organisation, you ensure a
buy-in and a sense of ownership
concerning privacy.
What advice do you have for
organisations that process personal
data?
The first step is to map the risks
associated with the company data
processing activities. Only by doing
that, companies can adequately design
and prioritise the privacy deliverables
that should be implemented first.
Otherwise, they will have a privacy
program that is not going to solve
the daily privacy problems of the
organisation. Just like in any compliance
program, to build a successful privacy
program, companies must first know
what their real weaknesses are.
Companies
should
develop
a global
privacy
strategy that
speaks to all
markets
How to Design a Solid Privacy
and Data Protection Programme

2. The Legal Network - marcus
evans Summits group delivers
peer-to-peer information on
strategic matters, professional
t r e n d s a n d b r e a k t h r o u g h
innovations.
Please note that the Summit is a
closed business event and the
number of participants strictly
limited.
About the European Corporate Counsel Summit 2015
The European Corporate Counsel Summit is the premium forum bringing together
leading in-house counsel with specialist international law firms and legal services
providers. As an invitation-only event taking place behind closed doors, the summit
offers Global/European GCs an intimate environment for a focused discussion of key
new drivers shaping the legal profession. The Summit will take place at the Grande
Real Villa Itália, Cascais, Portugal, 23 - 24 November, 2015.
www.eccsummit.com
Contact
Luzdary Hammad, Press Manager, marcus evans, Summits Division
Tel: + 357 22 849 385
Email: press@marcusevanscy.com
All rights reserved. The above content may be republished or reproduced. Kindly
inform us by sending an email to press@marcusevanscy.com
About marcus evans Summits
marcus evans Summits are high level business forums for the world’s leading decision-makers to meet, learn and discuss
strategies and solutions. Held at exclusive locations around the world, these events provide attendees with a unique opportunity to
individually tailor their schedules of keynote presentations, case studies, roundtables and one-to-one business meetings.
For more information, please visit: www.marcusevans.com
Upcoming Events
Chief Litigation Officer Summit (North America) - www.chieflitigationofficersummit.com
IP Law European Summit - www.iplawsummiteurope.com
IP Law Summit (North America) - www.iplawsummit.com
To view the web version of this interview, please click here: www.eccsummit.com/JoaoTorresBarreiro