The GDPR is not merely an IT problem, neither is it merely a legal problem ... Our core business within Khagan is historically in Banking and Insurance. As in Healthcare, personal data is particularly sensitive in these industries. Our clients are companies of all sizes. They asked us what we had to propose to support them in their implementation of GDPR. This is the reason why we have decided to deal pragmatically and quickly with what is seen as one constraint more by many. Here after you will find the link to our vision of GDPR's implementation which is not exclusively based on IT or legal issues. Our approach is a pure application of the regulations.

1. BE0652853154-KHAGAN-Visitatiestraat134/001-9040GHENT–BELGIUM
PHONE+3293293118MAILcontact@khagan.eu
Clarifications
around GDPR
General Data Protection Regulation (GDPR), Regulation (EU) 2016/679

2. Allrightsreserved.©Khagan-20/11/18 page2 of10
Arnaud BRUN
Imanageandenergizelargeteamstogobeyondtheirownexpertiseand
drivethem to success ininternationalenvironments. To achievethis, I use the experi-
encegainedinthetelecommunicationandbroadcastsindustrieswhereIactedbothasbusiness
managerandbusinessunitdeveloper.
Jean-Christophe MATHONET
My experience as CFO and CRO, Board Member in financial services, within banks and
insurance compagnies, allows me to cover a wide range of topics: general management of
entities, Risk and finance management, corporate taxes, supervision of IT and operations,
accounting, budgeting, creation and restructuring of legal structures, regulatory reporting,
acquisitionofcompanies,operationalstatistics,andmanagementaccounting.

3. Allrightsreserved.©Khagan-20/11/18 page3 of10
The
GDPR
is not merely an
IT problem, neither is it
merely a legal problem ...
Our core business within Khagan is historically in Banking and Insurance. As in Healthcare,
personaldataisparticularlysensitiveinbothindustries.Ourclientsarecompaniesofallsizes.
TheyaskeduswhatweareproposingtosupportthemintheirGDPRimplementationandthat
is why we have decided to deal pragmatically and quickly with what is seen as one constraint
morebymany.
We could have written a positive note about why the GDPR is a good initiative. But given that
companiesmustfocusontheirbusinessandalreadydrownundernewconstraintsandregula-
tions,wesimplylimitedthispapertoourvisionoftheGDPRimplementation.

4. Allrightsreserved.©Khagan-20/11/18 page4 of10
GDPR is not an IT subject
More than half of the articles we see on the subject are driven by IT integration services
companies, or security vendors who are very effective at making the company IT security
watertightandhenceprotectingallofitsdata.It’sgood,butunfortunatelysomewhatreductive.
Inthebestcasetherewillbeaclassificationofthedataofthecompany,butthatwillleavegaps
openforanycontrolbyadataprotectionauthority.
GDPR is not a legal issue
A lot GDPR related articles present a contractual vision of the regulation. These articles often
start by frightening you and showing everything that you do wrong to push you in only
reviewing your internal and external contractual documents. They sometimes suggest that
someadditionalregistersbeputinplace.
The actions such articles suggest are necessary and in accordance with the demands of GDPR.

5. Allrightsreserved.©Khagan-20/11/18 page5 of10
GDPR is a distorting magnifier of the wrong habits taken by most of us in our training and
professional molds respectively: the engineers take refuge in a technical comfort zone when
the lawyers find refuge in the comfort of contracts. In both cases, the coherence brought by
the governance is lacking. Moreover, the alignment with the organization’s strategy is often
lacking.
The person in charge of
the GDPR is a rare bird
TheArticle37(5)oftheGDPR,explainsthattheDataProtectionOfficer(DPO)“shallbeselected
onthebasisofprofessionalskillsand,inparticular,itsexpertknowledgeofdataprotectionlaw
andpracticesandtheabilitytofulfilthetasksreferredtoinArticle39”.
Although Article 37(5) does not specify the skills that should be considered when appointing
the DPO, DPO’s must have expertise in national and European data protection laws and
practices and an in-depth understanding of GDPR. It can also prove to be helpful if the DPO
hasgonethroughaspecifictrainingcertifiedbytheauthorities.

6. Allrightsreserved.©Khagan-20/11/18 page6 of10
Understandingofthebusinessandoftheorganizationofthecontrollerisalsoarequirement.
The DPO should also have a good understanding of the processing operations carried out, as
wellastheinformationsystems,datasecurityanddataprotectionneedsofthecontroller.
In the case of a public authority, the DPO should also have a sound knowledge of the adminis-
trativerulesandproceduresoftheorganization.
It is important to understand that there are only self-proclaimed experts in GDPR because
there is no training duly validated by the control authorities. The authorities are themselves
intheprocessoframpingupandhadnotthetime,yet,tocertifytrainers.Nowadays,wenotice
that,withtwotofivedaysoftraining,youcanclaimtobeacertifiedDPO.
The Khagan approach
on the GDPR
Khagan leverages its banking and insurance expertise. In these industries, GDPR is a
“non-event” as most of the underlyingconcepts have always beenapplied. All our consultants
faced a very stringent and secure management of the IT systems and the data, be it from an
internaloranexternalpointofview.
As we have always done, we manage the GDPR with a pragmatic governance approach that
allows you and your partners to soundly face an audit by the regulator or any internal or
external complaint. Our implementation approach uses a set of documents that you can fit to

7. Allrightsreserved.©Khagan-20/11/18 page7 of10
yourneeds.Thesetmainlyincludes:
› › Achecklistandmethodologywithanintroductiontothetopicstobe
coveredandanexplanationofthemethodology,
› › Usefulprocedurestoimplementinyourcompany(customerrequests,
recruitment...)
› › Alistofcommunicationstoputinplace
› › FormsanddocumentstosupportyourGDPRpath(decisionstaken,
impactassessment,reporttothesupervisoryauthority)
› › Atemplateforthedatainventorytoknow,amongstothers,whereeach
informationislocated
› › Oneemptyprocessregisterandanotheralreadyfilledintoallowyouto
savetimeduringtheimplementation
› › Severalcontractualclausesalreadydraftedtoappendtoyourdifferent
contracts
Wealsoproposeanoutsourced-DPOservicebecauseweknowthatmanycompaniesdonothave
auditandcontrolstafftoindependentlymanagetheGDPRprocess.

8. Allrightsreserved.©Khagan-20/11/18 page8 of10
Want to talk about it?
Phone: +32 (0) 9 329 31 18
Email: contact@khagan.eu

9. Allrightsreserved.©Khagan-20/11/18 page9 of10
You can always contact us.
Arnaud Brun Jean-Christophe Mathonet
Director Associate
arnaud.brun@khagan.eu jc.mathonet@khagan.eu
+32493366215 +32475288423
French, English French, Dutch, English
Thérèse Haq Qazi
Associate
therese.haqqazi@khagan.eu
+32488408014
French, Dutch, English

10. www.khagan.eu