When to perform a Data Audit?<\/h2>\n\n\n\n![\"GDPR](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/04\/bigstock-155566952-300x300.jpg\")
Can you spot the hidden image?<\/figcaption><\/figure><\/div>\n\n\n\nWhen it comes to getting compliant with the GDPR, you\u2019re going to want to perform your data audit at the very outset. Keep in mind, the first data audit is likely going to be the most difficult one you perform. That\u2019s largely due to the fact that you need to map everything out and truly use it to gain visibility over your information flows.<\/p>\n\n\n\n
Of course, there will be additional data audits, compliance audits and other data management exercises along the way as you maintain compliance. But first you need to know where everything is. That first data audit is the one we\u2019re discussing today.<\/p>\n\n\n<\/span>\n\n\n\nIs it hard to perform a Data Audit?<\/h2>\n\n\n\n
Honestly, that all depends on the size of your operation. In theory, no, a data audit shouldn\u2019t be hard to perform. It may be tedious, but not hard. To help get you into the right mindset, we\u2019re going to cover some of the key questions your data audit needs to answer. Let these questions guide you as you proceed.<\/p>\n\n\n\n
- What data are we collecting?<\/li>
- Where are we storing the data?<\/li>
- How do we protect and document the data?<\/li>
- How long do we keep the data?<\/li>
- Do we have a function for every piece of data?<\/li>
- What is the process for honoring a request to delete data?<\/li><\/ul>\n\n\n\n
Obviously, there are other questions you\u2019ll need to focus on, too. But these six should set a solid foundation.<\/p>\n\n\n\n
Now that we have that settled, lets go about collecting the information you need to complete your audit.<\/p>\n\n\n\n
What data are we collecting?<\/h2>\n\n\n\n
The first question we need to answer may seem like the most obvious: what are we collecting? Now, to answer this you need to have a little more information about what data qualifies as \u201cpersonal data\u201d under the GDPR. There are two categories of personal data. The first is just your standard stuff, anything that can be used to identify an individual:<\/p>\n\n\n\n
- Name<\/li>
- Address<\/li>
- Email Address<\/li>
- IP Address<\/li>
- Cookies<\/li>
- Phone Number<\/li>
- Social Security Number<\/li>
- ID numbers<\/li><\/ul>\n\n\n\n
Then there is something called special categories of personal information, that pertains to:<\/p>\n\n\n\n
- Racial or ethnic origins<\/li>
- Health information<\/li>
- Political Opinions<\/li>
- Religious Beliefs<\/li>
- Union Activity<\/li>
- Sexual or Gender Identity<\/li><\/ul>\n\n\n\n
This second category requires special legal bases to process. Additionally, if you possess any personal data on children under the age of 16 you will need parental consent.<\/p>\n\n\n\n
Regardless, you need to go over your entire website (or websites) looking for any point at which you collect personal data. Make sure to map these out, too. Because later you\u2019ll need to come back and add GDPR privacy notices<\/a> to them.<\/p>\n\n\n\nBut for now, just make a complete accounting.<\/p>\n\n\n\n
Where are we storing the data?<\/h2>\n\n\n\n
The GDPR requires you to document where you\u2019re storing the personal data of EU citizens. For the sake of this audit, \u201cwhere\u201d refers to both a geographic location as well as what kind of mechanism you\u2019re using to store it\u2014whether that\u2019s in emails, documents, databases, backups, email lists, etc.<\/p>\n\n\n\n
So after you\u2019ve mapped out where you\u2019re collecting information and what it is you\u2019re collecting, you need to figure out where you\u2019re storing it all. Get granular. \u2018This subscription text field records email addresses in a database stored on a server in our New Jersey office.\u2019<\/em> That may seem excessive, but as we have said repeatedly: err on the side of caution.<\/p>\n\n\n\nIt\u2019s better to be excessively cautious than to become a cautionary tale.<\/p>\n\n\n\n
How do we protect and document the data?<\/h2>\n\n\n\n
Again, this is a fairly straightforward question to answer. What safeguards are in place protecting the data you have stored. Do you use passwords to help protect the data? How do you store the passwords? Are they hashed? Salted?<\/a> Do you limit access to parts of your site? What about to your databases? Are you collecting this data over a secured HTTPS connection? Do you encrypt your data at rest?<\/p>\n\n\n\nThese are the kinds of questions that need to be answered.<\/p>\n\n\n\n
This is also an excellent opportunity to assess whether your organization is doing enough to secure the information that it collects. If the list of safeguards you have in place seems kind of short, it may be smart to discuss what safeguards you haven\u2019t added yet and how you can incorporate them. Take the GDPR as an opportunity to get your house in order.<\/strong> It will pay off in the long run.<\/p>\n\n\n\nHow long do we keep the data?<\/h2>\n\n\n\n
Like so many other things in the GDPR, the maximum amount of time an organization should store data for is ill-defined. The EU simply says to retain data \u201cno longer than necessary.\u201d Great.<\/p>\n\n\n\n
Ideally, the GDPR wants you to dispose of personal data once its served its purpose, but without providing any timelines it can be difficult to figure out what an appropriate length of time to keep personal data is. Part of the reason for this is that different organizations have different needs, and a blanket approach wouldn\u2019t fit very well.<\/p>\n\n\n\n
Your organization should decide what is appropriate for itself. Here are some things to consider:<\/p>\n\n\n\n
- The value of the information, both now and in the future<\/li>
- The costs and risks of continuing to store the data<\/li>
- The ease of keeping it maintained and accurate<\/li><\/ul>\n\n\n\n
Additionally you\u2019ll also need to consider how you\u2019re using the data, any additional legal or regulatory requirements and what is generally considered a best practice in your industry.<\/p>\n\n\n\n
If you\u2019re storing data indefinitely you need to put an end to that immediately.<\/p>\n\n\n\n
Do we have a use for every piece of data?<\/h2>\n\n\n\n
Every piece of personal data you collect should have a purpose. Ideally you should be able to explain that purpose at the point of collection, too. So what are you using this data for? Is it for completing a transaction? Are you adding it to an email subscriber list? Are you using it to tailor a better website experience or deliver better customer service?<\/p>\n\n\n\n
If you mapped out all of your data collection points earlier, this should be easy. And any data that isn\u2019t being collected for a specific purpose needs to be deleted. The days of grabbing as much information about a user just for the sake of having it are long gone. The data you collect needs to be collected for an express purpose\u2014one that is clearly articulated to your customers.<\/p>\n\n\n\n\n\n
What is the process for honoring a request to delete data?<\/h2>\n\n\n\n
Finally, you need to figure out how you\u2019re going to honor the right to be forgotten<\/a>. This EU right gives citizens the ability to take control over their personal information, including to modify or delete it.<\/p>\n\n\n\nThat means you need a mechanism in place for quickly gathering any stored data and then delivering it to the data subject. The two main questions you need to answer here are:<\/p>\n\n\n\n
- Whose responsibility is it to respond to data requests from users?<\/li>
- What records need to be checked to provide said data?<\/li><\/ol>\n\n\n\n
Once you know this, you should have all the information you need to complete your GDRP data audit.<\/p>\n\n\n\n![\"Data](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/04\/bigstock-223232884.jpg\")
<\/figure>\n\n\n\n <\/h2>\n\n\n\nGDPR Data Audit Checklist<\/h2>\n\n\n\n
Here\u2019s a quick checklist to help you work through your Data Audit.<\/p>\n\n\n\n
When it comes to getting compliant with the GDPR, you\u2019re going to want to perform your data audit at the very outset. Keep in mind, the first data audit is likely going to be the most difficult one you perform. That\u2019s largely due to the fact that you need to map everything out and truly use it to gain visibility over your information flows.<\/p>\n\n\n\n
Of course, there will be additional data audits, compliance audits and other data management exercises along the way as you maintain compliance. But first you need to know where everything is. That first data audit is the one we\u2019re discussing today.<\/p>\n\n\n<\/span>\n\n\n\n Honestly, that all depends on the size of your operation. In theory, no, a data audit shouldn\u2019t be hard to perform. It may be tedious, but not hard. To help get you into the right mindset, we\u2019re going to cover some of the key questions your data audit needs to answer. Let these questions guide you as you proceed.<\/p>\n\n\n\n Obviously, there are other questions you\u2019ll need to focus on, too. But these six should set a solid foundation.<\/p>\n\n\n\n Now that we have that settled, lets go about collecting the information you need to complete your audit.<\/p>\n\n\n\n The first question we need to answer may seem like the most obvious: what are we collecting? Now, to answer this you need to have a little more information about what data qualifies as \u201cpersonal data\u201d under the GDPR. There are two categories of personal data. The first is just your standard stuff, anything that can be used to identify an individual:<\/p>\n\n\n\n Then there is something called special categories of personal information, that pertains to:<\/p>\n\n\n\n This second category requires special legal bases to process. Additionally, if you possess any personal data on children under the age of 16 you will need parental consent.<\/p>\n\n\n\n Regardless, you need to go over your entire website (or websites) looking for any point at which you collect personal data. Make sure to map these out, too. Because later you\u2019ll need to come back and add GDPR privacy notices<\/a> to them.<\/p>\n\n\n\n But for now, just make a complete accounting.<\/p>\n\n\n\n The GDPR requires you to document where you\u2019re storing the personal data of EU citizens. For the sake of this audit, \u201cwhere\u201d refers to both a geographic location as well as what kind of mechanism you\u2019re using to store it\u2014whether that\u2019s in emails, documents, databases, backups, email lists, etc.<\/p>\n\n\n\n So after you\u2019ve mapped out where you\u2019re collecting information and what it is you\u2019re collecting, you need to figure out where you\u2019re storing it all. Get granular. \u2018This subscription text field records email addresses in a database stored on a server in our New Jersey office.\u2019<\/em> That may seem excessive, but as we have said repeatedly: err on the side of caution.<\/p>\n\n\n\n It\u2019s better to be excessively cautious than to become a cautionary tale.<\/p>\n\n\n\n Again, this is a fairly straightforward question to answer. What safeguards are in place protecting the data you have stored. Do you use passwords to help protect the data? How do you store the passwords? Are they hashed? Salted?<\/a> Do you limit access to parts of your site? What about to your databases? Are you collecting this data over a secured HTTPS connection? Do you encrypt your data at rest?<\/p>\n\n\n\n These are the kinds of questions that need to be answered.<\/p>\n\n\n\n This is also an excellent opportunity to assess whether your organization is doing enough to secure the information that it collects. If the list of safeguards you have in place seems kind of short, it may be smart to discuss what safeguards you haven\u2019t added yet and how you can incorporate them. Take the GDPR as an opportunity to get your house in order.<\/strong> It will pay off in the long run.<\/p>\n\n\n\n Like so many other things in the GDPR, the maximum amount of time an organization should store data for is ill-defined. The EU simply says to retain data \u201cno longer than necessary.\u201d Great.<\/p>\n\n\n\n Ideally, the GDPR wants you to dispose of personal data once its served its purpose, but without providing any timelines it can be difficult to figure out what an appropriate length of time to keep personal data is. Part of the reason for this is that different organizations have different needs, and a blanket approach wouldn\u2019t fit very well.<\/p>\n\n\n\n Your organization should decide what is appropriate for itself. Here are some things to consider:<\/p>\n\n\n\n Additionally you\u2019ll also need to consider how you\u2019re using the data, any additional legal or regulatory requirements and what is generally considered a best practice in your industry.<\/p>\n\n\n\n If you\u2019re storing data indefinitely you need to put an end to that immediately.<\/p>\n\n\n\n Every piece of personal data you collect should have a purpose. Ideally you should be able to explain that purpose at the point of collection, too. So what are you using this data for? Is it for completing a transaction? Are you adding it to an email subscriber list? Are you using it to tailor a better website experience or deliver better customer service?<\/p>\n\n\n\n If you mapped out all of your data collection points earlier, this should be easy. And any data that isn\u2019t being collected for a specific purpose needs to be deleted. The days of grabbing as much information about a user just for the sake of having it are long gone. The data you collect needs to be collected for an express purpose\u2014one that is clearly articulated to your customers.<\/p>\n\n\n\n\n\n Finally, you need to figure out how you\u2019re going to honor the right to be forgotten<\/a>. This EU right gives citizens the ability to take control over their personal information, including to modify or delete it.<\/p>\n\n\n\n That means you need a mechanism in place for quickly gathering any stored data and then delivering it to the data subject. The two main questions you need to answer here are:<\/p>\n\n\n\n Once you know this, you should have all the information you need to complete your GDRP data audit.<\/p>\n\n\n\n Here\u2019s a quick checklist to help you work through your Data Audit.<\/p>\n\n\n\nIs it hard to perform a Data Audit?<\/h2>\n\n\n\n
What data are we collecting?<\/h2>\n\n\n\n
Where are we storing the data?<\/h2>\n\n\n\n
How do we protect and document the data?<\/h2>\n\n\n\n
How long do we keep the data?<\/h2>\n\n\n\n
Do we have a use for every piece of data?<\/h2>\n\n\n\n
What is the process for honoring a request to delete data?<\/h2>\n\n\n\n
<\/figure>\n\n\n\n <\/h2>\n\n\n\n
GDPR Data Audit Checklist<\/h2>\n\n\n\n