The European Union’s proposed General Data Protection Regulation (GDPR) has left even the most informed confused. This new regulation has been designed to update the current directive which was drafted in a time that was in technology terms, prehistoric. It’s time to evolve.

1. The Evolution of Data Privacy
3 things you need to consider
A Symantec Information Security Perspective on EU Privacy Regulations

2. The Evolution of Data Privacy2
Prehistoric Protection
The European Union’s proposed General
Data Protection Regulation (GDPR) has
left even the most informed confused.
This new regulation has been designed
to update the current directive which
was drafted in a time that was in
technology terms, prehistoric.
It’s time to evolve.
Data breaches and security threats constantly remind
us of the need to improve the monitoring and protection
of corporate and personal data. Public and government
pressure to better protect it will usher in a new age of fit-
for-purpose regulation.
The new GDPR aims to harmonise and
update current data protection laws across
a much expanded EU zone of:
- 28 countries
- half a billion citizens
- producing $18 trillion
every year
Prehistoric Protection

3. A Symantec Information Security Perspective on EU Privacy Regulations 3
The impending changes for protecting personal data
for all citizens will impose stricter fines on companies
mismanaging data or failing to protect it properly.
The new rights around access and erasure, the role and
liability of Data Controller versus Data Processors are all
new challenges. The good news is we can help you with the
groundwork on all these complex topics.
Here are three things you need to consider.

4. The Evolution of Data Privacy4
1. Controller versus Processor
The new regulation, like the one it
replaces, impacts both ‘Data Controllers’
and ‘Data Processors’. Data Controllers
must exercise control over the
processing and carry data protection
responsibility for it.
Data Processors also have detailed
obligations. So, which are you?
Which are you?
Data Controller -
an organization who (either alone or jointly or in common
with other organizations) determines the purposes for
which, and the manner in which, any personal data is
collected, or is to be processed.
Data Processor –
any organization (other than the data controller itself and
its employees) who processes the personal data on behalf
of the data controller.

5. A Symantec Information Security Perspective on EU Privacy Regulations 5
The distinction between a Data
Controller and Data Processor
has significant real-world
consequences. For example,
following a data breach it is
essential for both to determine
where responsibility lies.
To make this a little more
complex, you are more than
likely to be considered both
Controller and Processor.

6. The Evolution of Data Privacy6
2. Clean Little and Often
Four simple questions demonstrate
the scale of the issues that
GDPR compliance may present to
organizations:
- What data do I have?
- Where is the data stored and for
how long?
- Who has access to it?
- Am I using it for the reason I originally
collected it?
With the consumerisation of IT rife within organizations
today, many would struggle to understand not just where,
but how, their data flows and proliferates around their
organization.

7. A Symantec Information Security Perspective on EU Privacy Regulations 7
But all is not lost. If we look at data management as like
doing your tax declaration or a spring clean, you can
understand the benefit of automating data retention,
storage and back up. By reviewing, storing and collating
data daily, you will be in the position to quickly prove that
you are on top of the data management procedures needed
to meet the GDPR.
This is essential when being audited, or if you have to
prove compliance to the authorities.

8. The Evolution of Data Privacy8
3. Don’t wait for the legislation
Look at what you need to protect today
to prepare you for complying with the
regulation. Ensuring you implement
the best practices and have built in
privacy by design will notably make you
more prepared to comply with it whilst
reducing risk and costs.
However, applying a tick box mentality to compliance with
the GDPR is unlikely to succeed. When designing your
privacy protection, Symantec recommends these eight key
considerations:
1. Which IT systems or other methods are used to collect
personal data?
2. Where, how and why are you storing personal data?
3. Which security processes protect the personal data you
store?
4. How do you retrieve personal data about certain
individuals?
5. How do you ensure a retention schedule is adhered to?
6. How do you transfer the personal data from one
organization to another?
7. How do you delete or dispose of the data?
8. Can you control the personal data you use across your
business from creation to deletion?

9. A Symantec Information Security Perspective on EU Privacy Regulations 9
Unfortunately, even the appropriate answers to the above
questions will not protect you fully. There is no ‘One size
fits all’ solution to personal privacy.
So, other than challenging yourself with “How do I comply
with the regulation?” look at how your data is secured.
Doing so will likely help you achieve early compliance.

10. Evolved from Europe - A New Species of Data Privacy10
The road to compliance
The GDPR will force businesses to take
precautions in processing personal data
to a new level. It will pay to remember
for which data you are Data Controller
and Data Processor, bearing in mind you
may be both. For each organization the
solution to securing information will
differ, but there are common themes to
comply with the GDPR.
- Embed GDPR compliance into your security
program. This will simplify and drive efficiency
of the GDPR project.
- Secure enterprise data holistically, not one step at a
time, project-by-project, or function-by-function. This
should be driven by the business as a whole, not just IT,
to evolve security behaviours across the organization.

11. A Symantec Information Security Perspective on EU Privacy Regulations 11
- Undertake appropriate due
diligence for new suppliers,
systems and processes and make
this a cornerstone of information
governance.
For more
information,
download the
entire easy-to-
read Perspective
on Information
Security here.

12. Symantec EMEA Headquarters, 350 Brook Drive, Green
Park, Reading RG2 6UH
Tel: +44 (0)870 243 1080
Copyright © 2015 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, and the Checkmark Logo are
trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names
may be trademarks of their respective owners. Designed by StoneCreativeDesign.com
symantec.com