12th July GDPR event slides

#GDPREXPO
WELCOME TO
THE HILTON HOTEL
ARE YOU READY FOR
THE CHALLENGE OF GDPR?

AGENDA 11:30 - 12:00 Arrival & Registrations.
12:00 - 12:20 Welcome & Introduction to Exponential-e:
Lee Wade - CEO & Founder, Exponential-e.
12:20 - 13:00 Are you ready for GDPR?
Neil May - Director of Technology Risk Management, Newable.
13:00 - 13:15 Break.
13:15 - 13:45 GDPR: Gap Analysis & Remediation Plans:
Neil May - Director of Technology Risk Management, Newable.
13:45 - 14:15 GDPR and Data Security:
Jeff Finch - Head of Security Services, Exponential-e.
14:15 - 14:40 QA & Panel Discussion.
14:40 - 15:00 Lunch and Networking.

#GDPREXPO
ARE YOU READY FOR
THE CHALLENGE OF
GDPR?
LEE WADE
CEO & FOUNDER, EXPONENTIAL-E.

www.exponential-e.com
GDPR OVERVIEW
GDPR Overview
• GDPR is a long-overdue upgrade to the existing Data Protection Act 1998
• Fundamentally, businesses need to be more transparent about the personal data they hold; why they
captured it and what they intend to do with it
• The concept is simple: if I have given you my data, then I should be able to retrieve it or even transfer it to
someone else
• Companies who do not handle this data in line with the new rules could be faced with a hefty fine of up to 4%
of its global annual turnover, or €20,000,000, whichever is more . . .
• And that’s not all. Businesses that don’t comply risk legal action from the individuals whose personal data they
are using, since GDPR gives EU residents direct rights to obtain court orders and compensation

CONNECTIVITY
SERVICES
10GigE Business
Internet, SD-WAN,
Bandwith
Management,
Cloud Connect,
Superconnected Cities,
Software Defined
Networking
CLOUD SERVICES
Cloud for Enterprise,
Cloud-Network
solutions,
Desktop-as-a-Service,
DaaS GPU, Workplace
Recovery, IaaS (VDC),
Server Replication,
Online Backup,
Enhanced Analytics &
Big Data, Object &
HDFS Storage
VOICE & UNIFIED
COMMUNICATIONS
Hosted PBX, Smart
Audio Conferencing,
Inbound Call
Management, SIP
Trunking, Call
Recording.
DATA CENTRE
SERVICES
Enterprise-class
Colocation, Managed
Colocation, Shared
Colocation, Smart
Hands
SERVICE PORTFOLIO
MANAGED IT
& PROFESSIONAL
SERVICES
Professional Services,
Managed Services,
Digital Transformation,
AWS/Azure
Management,
Network Monitoring,
Windows Server 2003
SECURITY SERVICES
CyberSecurity & consultancy, PEN Testing, SSL VPN , Firewall design

A SELECTION OF CLIENTS

GDPR OVERVIEW
GDPR Overview
This morning, we will cover off many questions about GDPR Compliance such as:
• Understanding the implications of GDPR
• Understanding the new obligations to achieve compliance.
• Preparing for GDPR: Discovery and Remediation plans
• What exactly is ‘explicit consent’?
• What are the implications for my data stored in my CRM system?
• What is the ‘right to be forgotten’ and what does this mean for my data?
• What does ‘pseudonymisation’ mean for all my encrypted data files?
• Will the auditors sign off my 2018 accounts if we are not GDPR compliant next year?
• Do we ALL now really need a Data Protection Officer?

GDPR OVERVIEW
GDPR Overview
• The General Data Protection Regulation (GDPR) is the European’s view on what the baseline expectations are
for processing personal information of EU citizens as we continue through the digital revolution
• The GDPR introduces a raft of onerous and complex requirements and regulations
• Importantly, for the first time we will have a single set of privacy rules across EU member states, and this
harmonization goes even further as the GDPR has cross-territorial implications
• It comes into force in the UK in May 25th, 2018 – And we all have a lot of work to do!
We have 317 days left to prepare for GDPR

GDPR OVERVIEW
GDPR transforms a number of existing requirements and introduces a raft of new ones.
GDPR Coalition

GDPR OVERVIEW – SIMPLE GAME PLAN
2
DO AN
ASSESSMENT
Undertake a broad
Data Protection
Assessment of your
organisation
3
DO A GAP
ANALYSIS
Compliance: Where
you are vs Where you
need to be for GDPR
6
DECIDE IF
A DPO IS
REQUIRED
Become aware
and take action! 1
TAKE ACTION
Roll out training across
your organisation
Create a detailed Compliance
Roadmap with clear timelines
4
TRAIN YOUR
STAFF
5
CREATE A
ROADMAP
If you need to appoint a qualified
Data Protection Officer

GDPR OVERVIEW
COMPREHENSIVE GAME PLAN

GDPR – WHY NOW?
GDPR – Why Now?
The interdependence between data sharing and data privacy
• Companies know more about their customers than ever before. In the last 24 hours, your company probably
amassed more information about customers than was conceivable a decade ago
• As consumers, we benefit from this closeness. The fitness apps that tracks our steps, the messaging apps we
use to send pictures from the beach, or the telematics technology in our cars that lowers our insurance
premiums
• When we use our iPads and smart phones there is often an assumed understanding: we’ll give you our
data/information in exchange for that excellent service or product that makes our lives easier, richer and
sometimes cheaper. This is the trade-off at the heart of the digital economy
• But there are limits to this trade-off. People are increasingly aware that companies are collecting, using,
retaining and sharing their information - including buying and selling it! And they are growing uneasy . . .

GDPR OVERVIEW
THE DRIVE TOWARDS DATA PRIVACY
• But our willingness to share our personal information varies dramatically
according to gender, age, wealth, nationality and education . . .
• More than 50% are willing to share information about gender, ethnicity & education whilst
less than 20% are willing to share their income, location, medical records or address.
• Surveys reveal that 43% of people are uneasy about smart meters in their homes
• Many people in all countries are concerned about wi-fi data analytics and
web-browser spying
• In spite of our ‘uneasiness’ in the way corporates are utilizing our data, personal data is
the fuel of the digital future and the enabler of disruptive technologies

• Hence, GDPR marks a fundamental shift towards the view that PRIVACY must be at the
forefront of organizations’ minds when dealing with our personal data
• It is the most comprehensive attempt to define a coherent regulatory framework for privacy.
Governments around the world are sharpening their focus on the issue and introducing
legislation to offer greater protection to consumers — and far harsher penalties for
violations
• Hence, companies need to consider a new attitude to privacy—and they need to do it
quickly to minimize the risks to their balance sheet and their reputation
• GDPR CATAPULTS PRIVACY towards the top of organizations’ risk radars
GDPR OVERVIEW
THE DRIVE TOWARDS DATA PRIVACY

PREPARING FOR GDPR
ICO CHECKLIST SUMMARY
1. Awareness (Raising awareness throughout the organisation) 7. Explicit consent (Needs your urgent attention now)
You should review NOW how you seek, record and manage consent
and whether you need to make any changes.
2. Review the information you hold – (Data Discovery) 8. Children (Extra measures if you process child personal data)
3. Review the current privacy notices you send 9. Data breaches (Must be reported within 72 hours)
4. Individual Rights 10. Data Protection by Design – (Promotes Privacy & Data Protection)
Check your procedures to ensure they cover all the rights
individuals have, including how you would delete personal data or provide 11. Data Protection Officer (Do you need one?)
data electronically and in a commonly used format. 12. International – Cross – border trading checks
The main rights for individuals under the GDPR will be:
• the right to be informed;
• the right of access;
• the right to rectification;
• the right to erasure;
• the right to restrict processing;
• the right to data portability;
• the right to object; and
• the right not to be subject to automated decision-making including profiling.
5. Subject Data Requests (Will be 30 days)
6. Lawful basis for processing personal data

PREPARING FOR GDPR
ICO CHECKLIST SUMMARY
ICO: GDPR Preparation Recommendations – 12 Point Checklist Available at:
https://ico.org.uk/media/1624219/preparing-for-the-gdpr-12-steps.pdf

GDPR COMPLIANCE
GDPR Compliance
• Although we only have 317 days - DON’T PANIC!
• The burden of compliance may be less onerous if you are ISO 27001/9001 or FCA accredited.
Processes may already exist for data privacy, disclosure, retention and management
• Many companies already employ Data Protection or compliance personnel
• Finally, Exponential-e & Newable can help guide you through the entire GDPR compliance process
starting with your Data Discovery and Remediation plans that Mark Childs will detail later on . . .

#GDPREXPO
ARE YOU
READY FOR GDPR?
NEIL MAY
DIRECTOR OF TECHNOLOGY RISK
MANAGEMENT, NEWABLE.

Are You Ready For GDPR?
Neil May – Director of Technology Risk Management
12 July 2017

Before we start
BREXIT
We are not off the GDPR hook. In fact, the UK will have to try extra-hard to prove
Adequacy.
4 July 2017PRIVATE AND CONFIDENTIAL3

Timetable
― EU directive formally adopted 25 May 2016
― 2 year implementation period
― Becomes law on the 25th May 2018 – everyone must be compliant by then.
― DCMS is still working on the UK legislation!
PRIVATE AND CONFIDENTIAL4 4 July 2017

The ‘New Y2K’
― An immovable deadline
― A technical deliverable
― A skills shortage
― Cue – PANIC in the boardroom
― Beware the snake oil salesmen

Beware
― No quick fixes
― If it seems to good to be true…..
― It is not possible to be ‘compliant’ yet – you can at best be ‘ready’
― Over 50 Articles yet to be fully defined

But – good news for IT!
― GDPR – the business finally has to accept ownership of its data
― It is no longer “IT’s problem”

General Data Protection Regulation
― Establish a single, pan-European law to replace the current inconsistent
patchwork of national laws
― Modernize the principles enshrined in the 1995 Data Protection Directive
― Immature internet
― No “cloud”
― No Facebook, Twitter, etc.
― No smartphones
― But, new principles much the same as the old ones

Benefits of the new Regulation
― Benefits for organisations
― One EU market, one law
― One-stop-shop – a single supervisory authority
― Same rules for all organisations
― Even those outside the EU
― Benefits for EU citizens
― Better data security
― Putting people in control

Some definitions
― More personal data covered (e.g. IP addresses; URLs)
― 'Pseudonymised data' is personal data
― Sensitive personal data extended (genetic, biometric, sexual orientation)
― Manual records extended (structured or unstructured)
― Main establishment and one stop shop: likely to involve a "concerned
supervisory authority"
― Issues resolved at the European Data
Protection Board

Data processing activities
― No requirement to notify ICO
― Data Controllers and Data Processors must keep a record of their processing
activities
― Must make available to the ICO on request

Impact assessments
― Requirement to perform privacy impact assessments
― Specifically where the processing of personal data is ‘likely to result in a high risk for the rights
and freedoms of individuals’
― Eg when processing personal data through new technologies or when engaging in people
profiling

Impact assessments
― If assessment reveals that processing of personal data would result in a high risk
(eg due to the absence of mitigating controls), data controllers will be required to
consult with the ICO
― If the ICO believes that any processing of personal data would be non-compliant
with the Regulation then:
― Advise data controller on how to proceed
― Require an organisation to undergo a data protection audit

Consent
― Consent given by data subjects must be “unambiguous” for all processing of
personal data
― Requires a “clear affirmative action”
― Consent has to be “explicit” for sensitive data
― Silence, pre-ticked boxes or inactivity does not constitute consent
― Must have an audit trail
― List brokers?

Right to be forgotten
― Data subject has the right to have his or her personal data
erased where the retention of data breaches the regulation
― The right to erasure does not provide an absolute right to be
forgotten
― Data Controller and Processors have an obligation to ensure
that any third party with whom data is shared also erase the
personal data unless it is impossible or involves
disproportionate effort to do so
Data
Subject

Liability
― Data controllers and data processors have shared liability
― Even more important to have proper contractual arrangements in place
― Processors as well as controllers must provide a security level “appropriate” to
the processing risks
― Risk assessments for each customer
― Varying standards of data security for different
types of processing

Data Protection Officer
― Mandatory appointment of a DPO for
― Public authority or body
― Those who monitor data subjects on a large scale
― Core activities process sensitive personal data
― ICO says so!
― Can be outsourced
― Must be…
― involved in all issues which relate to the protection of
personal data
― provided with necessary resources to perform their
required tasks

Data Protection Officer tasks
― To inform and advise the data controller, data processor and their employees of
their regulatory obligations
― To monitor compliance with the Regulation. Including…
― Policies
― Assignment of responsibilities
― Raising awareness and training of staff
― To provide advice, related to data protection
impact assessments and to monitor impact
assessment performance
― To cooperate with the ICO
― To act as the contact point for data subjects and
the ICO

Data Protection Officer position
― The Data Protection Officer must not receive any instructions regarding the
exercise of these tasks
― Independent, whether or not an employee
― They shall not be dismissed or penalised for performing
their tasks
― The Data Protection Officer shall directly report to the
highest management level of the controller or
the processor

Data breaches
― ICO must be notified within 72 hours of becoming aware of the breach
― Where this cannot be achieved within 72 hours, an explanation of the reasons for the delay
should accompany the notification and information may be provided in phases without undue
further delay
― The notification must at least…
― Describe the nature of the breach
― Communicate the name and contact details
of the Data Protection Officer or other
contact point where more information can
be obtained

Data breaches
― Fines for unprotected data breaches will range up to €20 million or 4% of annual
global turnover (whichever is higher!)
― If you suffer a breach and can show that the personal data can't be accessed by
unauthorized people (e.g. it was encrypted):
― The likelihood of being fined should be very greatly reduced
― You won't need to notify affected data subjects of the breach

Data portability
― Where processing of personal data is carried out
by automated means, the data subject should be
allowed to receive their personal data in a
structured, commonly used, machine-readable
and interoperable format and transmit it to
another controller.
― The data subject has the right to request that the
data is transmitted directly from controller to
controller where technically
feasible.

Contacts
Data protection by design
― Data protection must not be treated
as an afterthought or ignored
altogether
― Consider when…
― Building new IT systems for storing or
accessing personal data
― Developing policy or strategies that
have privacy implications
― Embarking on a
data sharing initiative
― Using data for new
purposes
PRIVATE AND CONFIDENTIAL41
Portfolio
Service
4 July 2017

Contacts
Data protection by design
― Potential problems are identified at
an early stage, when addressing
them will often be simpler and less
costly
― Increased awareness of privacy and
data protection across an
organisation
― Organisations are more likely to meet
their legal obligations
― Actions are less likely to be privacy
intrusive and have a
negative impact on
individuals
PRIVATE AND CONFIDENTIAL42
Portfolio
Service
4 July 2017

Codes of practice
― Codes of practice (or "codes of conduct" to use the correct Regulation-speak)
become more important
― If one DP authority produces a code of practice it can be more or less adopted in
other countries
― European Data Protection Board has a role

Codes of practice
― In the UK there are already Codes of Practice in areas such as Marketing, CCTV,
Human Resources, Direct Marketing, Subject Access, Privacy Impact
Assessments, Personal Information Online and Data Sharing
― Aligning data protection procedures now with the content of ICO Codes of
Practice should get you ahead of the field

Suggested Codes of Conduct
― Processing in the data controller's legitimate interests
― Consumer rights & dispute resolution procedures
― Fair data collection and transparency re data processing
― Pseudonymisation of personal data
― Exercise of their rights of data subjects
― Protection of children
― Security of processing and data loss
― Transfers of data to other countries

What to do now?
― Be compliant with the DPA 1998!
― Know what personal data you process
― Data permeation maps
― Where does the data come from?
― What do we do with it?
― Where does it go?
― Information asset inventory

What to do now?
― Ensure policies and procedures are up to date and relevant
― Review information security arrangements
― In processing personal data, be
― Fair
― Transparent
― Understand your basis of data processing!

#GDPREXPO
GDPR: GAP ANALYSIS
& REMEDIATION
PLANS:
NEIL MAY
DIRECTOR OF TECHNOLOGY RISK
MANAGEMENT, NEWABLE.

Gap Analysis and
Remediation Plans
Neil May – Director of Technology Risk Management
12 July 2017

Why do you need a Gap Analysis
― The GDPR contains 99 articles
― Article “a separate clause or paragraph of a legal document or agreement, typically one outlining
a single rule or regulation”
― The GDPR contains 173 recitals
― Recital “the part of a legal document that explains its purpose and gives other factual information”
― Do you think you have the capability to successfully
interpret all of these on your own?

There is a lot of rubbish talked about GDPR!
― If somebody tells you they can make you GDPR compliant they simply aren’t
credible!!
― The GDPR will be enforced from May 2018 and is now well into the implementation period
― EU member states are able to vary aspects of the GDPR even though it is a Regulation, designed
to harmonise data protection law. These parts that can be varied are known as derogations
― The Department of Culture, Media and Sport (DCMS) who run the consultation said: “The UK
pressed hard throughout negotiations to ensure that the GDPR does not place unnecessary
burdens on business. There are also derogations (exemptions) within the GDPR where the UK
can exercise discretion over how certain provisions will apply.”
― An example of a derogation in the GDPR is the age of consent for children, which can be set
between 13-16 years old. It is up to a member state to decide and this consultation will address
these questions

NO YOU WON’T!!!!!
So where does that leave us?
― There are still 50 articles that the DCMS needs to ratify.
― Well on the basis I’ll wait then…..

The Act comes into force May 2018!!
― All countries in the EEA will need to be fully complaint with all of the requirements
at this time
― Failure to do so and you are risking considerable fines and reputational damage
to your business
― The current fines regime is set at €20 million or 4% of your annual global turnover, whichever is
the higher
― Countries who process European Subjects data are not exempt
― For example, if you have offices in the Middle
East and process European Subject Data you
are “in-scope”

So what does a Gap Analysis look like?
― There is no such thing as a “typical gap analysis”
― All organisations are different so the duration required to perform one ranges from
days to weeks to months depending on size, complexity etc.
― So where do you start?
― Do you understand your “Data Estate”?
― Are you able to evidence this?
― Do you have an Information Asset Inventory?
― Do you have a record of all of your 3rd Parties who process
personal data on your behalf?

So what does a Gap Analysis look like?
― So where do you start?
― Have all of your staff including contractors, part-time, volunteers etc. received Data Protection
Awareness Training and do they receive this on a regular basis?
― Have you received unambiguous Positive Consent from all of your Staff, Clients etc.as to how
you intend to process their data?
― Have you received unambiguous Positive Consent from all
of your clients held on your current CRM system(s) as
to how you intend to process their data?

Should I be concerned?
― If you aren’t then you should be!!
― GDPR is probably the single most ground breaking piece of legislation that has
come into force in the past 20yrs
― The Gap Analysis is just the start of it. This will:
― Identify as to where you are and aren’t complaint with the proposed GDPR
― It will provide you with a set of Data Permeation Maps,
which map your respective personal data flows in the
business; this will include both Logical and Physical
data namely your Data Estate
― It will provide you with an indication of the effort
required to bring yourself to being GDPR ready
― So what's next?

Remediation plans
― Please don’t underestimate the time you will require for remediation
― GDPR came into force in May 2016 and you have until May 2018 to be compliant
― 2 years is probably a reasonable estimate as to how long it would take the
average business to perform a gap analysis and put in place controls and
measures, to demonstrate that they were GDPR ready
― No matter what the size or complexity of your organisation GDPR will have an
impact on how you do business
― Unfortunately most businesses have significantly underestimated the impact of
GDPR or are simply in denial!

Remediation plans
― Lets start with some good advice. As a minimum you will need to consider:
― Data Permeation Maps
― Data Inventory
― Data Protection Officer
― Data Protection Training and Awareness
― Data Protection Policies and Procedures
― Third Party Assurance Programme
― Third Party Contracts
― Penetration Testing and Vulnerability Analysis

Remediation plans
― Lets start with some good advice. As a minimum you will need to consider:
― The Right To Be Forgotten
― Subject Access Requests
― Privacy by Design
― Privacy Impact Assessments
― Positive Consent
― CRM Systems
― CCTV
― Data Portability
― Cross Border Transfers

What to do now?
― There is no time like the present:
― Get yourself a copy of the GDPR
― Perform a Gap Analysis
― Produce a Remediation Plan - You have less than a year to get yourself GDPR ready
― Do not underestimate the time and effort required - YES it is going to cost ££s so budget for it.
― Ignore it at your peril!!! Compliance is not an option – this is the law!

#GDPREXPO
GDPR &
CYBER SECURITY
JEFF FINCH
HEAD OF SECURITY SERVICES

www.exponential-e.com #GDPREXPO
CYBER SECURITY BY DESIGN
• GDPR, Articles 25, 32, 33,34, and 35 contain details on securing data
• The Top Five
• Discover the weaknesses
• Privacy by Design = Security By Design
• Security Appropriate to Risk
• The Principle of Least Privilege
• Better Control of Customer Data
• How can we support you?

DISCOVER THE WEAKNESSES
• The world of self denial!
• Your own audit will not find it!
• Independent assessment of where you are.
• Exponential-e provide access to trusted renowned partners in this field.
• Pen Test Partners LLP.
• We facilitate! Its the customers report!
• And they are accredited.

PRIVACY BY DESIGN
SECURITY BY DESIGN
We take Security Seriously:
• All our Solutions Engineers are trained to High Standards.
• Platinum Partner with Fortinet.
• MSP Partner Palo Alto.
• Gold Partner for Gemalto / Safenet.
• Senior Partner for Foresite.
• Only MSP Partner for Sentinel One.
• We design based on the solution you need.
• Our Partners ensure we are well trained.

SECURITY APPROPRIATE TO RISK.
THE PRINCIPLE OF LEAST PRIVILEGE.
• How do you judge these two?
• Evaluate the risk and impose the security!
• How often do you review users privileges?
• Advanced Security Monitoring
• Log collection and correlation from any device under one pane of glass!
• Generates reports
• Has 24 x 7 Analyst support
• Alerts and advice on remediation

BETTER CONTROL OF CUSTOMER DATA
Where’s The Cloud for Exponential-e ?
• Cloud Storage is located within UK Borders.
• We Provide encryption.
• Structured Storage offering dedicated arrays.
• Which means that customers can store in a
structured, searchable, encrypted platform their
essential data which is already GDPR ready!
What does The Exponential-e Cloud provide to our
Customers ?
• Information Governance.
• Configurable to meet regulatory and compliance
standards.
• Provides a Data classification application
• On Structured and unstructured data
• Regardless of where data resides (premises or
Cloud).
• Data ownership, Data retention periods, Data
Sensitivity.

A Unified Platform
Use a single platform for data governance and
policy management, and extend data
governance and control to cloud-based data.

A UNIFIED PLATFORM
• By knowing exactly where personal data lives across your organization, you can:
o Identify the presence of personal data in all data locations.
o Automate special handling of information with standard data policies (i.e., access control, security,
encryption, retention).
o Support the export and erasure of personal data from all data sources.
o Detect and delete unneeded copies of personal data.
o Maintain an auditable chain of custody on an individual's personal data.
o Understand data leakage risk and speed up data breach analysis.

#EXPO-GDPR
THE
SECURITY PRODUCT
PORTFOLIO
Customer Applications
Internet
Customer Perimeter
Customer VPN / Network
Ransomware Protection
Email & Content Filter
Next Gen UTM
Pen Test & IT Health Check
DDoS Mitigation
GRC Consultancy
Advanced Firewall Monitoring
Multi Factor Authentication
Next Gen Firewall
Web & URL

12th July GDPR event slides

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to 12th July GDPR event slides

Similar to 12th July GDPR event slides (20)

More from Exponential_e

More from Exponential_e (14)

Recently uploaded

Recently uploaded (20)

12th July GDPR event slides

Editor's Notes