bullet like presentation on GDPR

2. Motivation of the act
• Give people control over their data
• To know how personal data was collected, how is it being processed, stored, gave out
• Review and correct personal data
• Opt out, restrict to use, right to be forgotten (to purge personal info)
• Opt out automated decision making
• Export their records
• Ensure data protection (more parties involved, higher penalties, etc.)

3. Personal data examples
• Address, Name, Surname, Age
• Phone number
• Device identifiers
• Cookie IDs
• IP addresses
• Email
• Ethnity/Race
• Political party/Views
• Union membership
• Medical information
• Photos
• Sensitive includes genetic and biometric data

4. It is applied to
• Presence in EU country
• Goods or services are sold to EU citizens
• Monitor behaviour of EU citizens
• Process data of a company from above
• You are EU citizen
Problems:
• Not clear how punishment to non EU companies will be applied
• Not fully defined
• No real cases (Case law)
• No standards
• No certifications

5. Security issues
• Encryption
• Data loss prevention
• Restrict mass storage devices
• Monitor outgoing traffic
• Endpoint protection
• Cookie IDs
• Auditing and logging
• Testing and assessment
• Breach notifications

6. Real practical steps
• Consult legal council
• Decide if your organization if required to have Data Protection Officer
• Find and classify all personal data
• Make diagrams
• Classification
• Dataflow diagrams
• Settle processes for: Anonymization processes
• Anonymization
• Data give out/purge and all other interactions with clients
• Data retention
• Testing and assessment
• Breach notifications (72 hours)

7. Some highlights
• Most of GDPR are complaints issues
• Penalties up to 4% of global turnover
• Take into account regulation in other countries
• Understand where your data is stored (inside country, EU, outside),
if copied to somewhere else. Data shouldn’t be transferred to other countries without
adequate protection.
• Each EU member will add their own regulation to GDPR.
• The act itself is in action from May 2018