You cannot protect personal data you cannot locate
The hardest question in a privacy programme is where the personal data is, right now, and who can reach it. Writing the policy is easy by comparison. And the hard question has a real answer.
The Gwenda Team · · 2 min read
Article 5(2) of the GDPR contains the word that turns privacy from a legal problem into an operational one: demonstrate. Being compliant only counts when you can show it.
The Australian Privacy Act arrives at a similar place by a different route. APP 11 requires reasonable steps to protect personal information, and "reasonable" is judged against what a comparable organisation would do, which increasingly means something resembling the Essential Eight.
The record of processing problem
Most organisations have a record of processing activities. It was usually compiled in a workshop somewhere between one and three years ago, and it describes systems that have since been replaced.
Blaming the documentation misses the point. The failure is structural: a document maintained by hand will always drift from infrastructure that changes weekly.
The breach clock is the forcing function
Both regimes put you on a timer, and the timers do not match:
- GDPR: notify the supervisory authority within 72 hours of becoming aware, where the breach is likely to result in a risk to individuals.
- Australia's NDB scheme: carry out a reasonable and expeditious assessment (the scheme expects this within 30 days) and notify where serious harm is likely.
Organisations that cannot answer "what was in that system, and who could reach it" spend most of their clock establishing facts. Organisations that already have a current data map spend it on the decision.
The uncomfortable implication is that your breach response quality is largely determined months before the breach, by whether anyone was maintaining the map.
Questions worth being able to answer today
- Which systems hold personal data, including the ones nobody registered?
- Which third parties have access, with what scopes, and which of them sit outside the EEA?
- Is the retention your policy claims actually enforced by the system holding the data?
If any of those takes more than a day to answer, the answer during an incident will take longer.
Related
See where you actually stand.
Gwenda reads the applications you already run, discovers the controls you already have, and measures them against the gold standard for your industry.