6.4 Managing Enterprise Risk and Compliance

Key Principles of GDPR

The GDPR is built around seven key principles: lawfulness, fairness, and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality (security); and accountability. Understanding these principles is the foundation of any GDPR compliance audit. An audit should begin with an assessment of areas of potential need. Table 6.4 shows an example of how a company might identify potential actions to take in each area.

Data Mapping

An audit requires knowing where all types of personal data are stored, processed, and transferred within the organization. Data mapping serves as an essential precursor to effective data governance and compliance. A data mapping tool—which is a software application or platform that enables data professionals to automate the process of mapping data fields, attributes, or elements from source systems to target systems or destinations—can be especially useful here. The tools listed in Table 6.5 can automate this process, identifying various data storage points across the organization’s infrastructure, including cloud services, databases, and even employee devices.

These data mapping tools offer advantages that go beyond mere identification. They can also categorize the identified data according to its sensitivity and the privacy risks it presents, thereby aiding in the prioritization of data protection efforts. For instance, personal identifiers such as Social Security numbers or medical records may be flagged as high-risk data requiring stricter security measures. By providing a more structured, visual representation of how data flows and resides within an organization, these tools allow for more effective planning and implementation of data privacy policies.

Data Processing Activities

The GDPR requires organizations to document how they process data. Therefore, understanding what kind of data are being collected, for what purpose, and how it is being processed and stored is essential. Additionally, the regulation mandates that companies maintain a detailed record of their data processing activities, from data collection to storage and eventual deletion.

This recordkeeping is not just a compliance requirement—it also serves a strategic function by fostering a culture of accountability and transparency. Failing to adhere to this detailed level of documentation can lead to significant legal consequences under GDPR.

In the context of Facebook, which faced public scrutiny for its data handling practices during the Cambridge Analytica scandal, GDPR compliance required the company to reevaluate its third-party app policies meticulously. Specifically, Facebook needed to document the kind of user data that was being accessed by third-party apps and for what purpose. This finding led Facebook to make changes in its API permissions, ensuring that data access by third-party apps would be more restricted and better aligned with GDPR principles. For example, apps would need explicit user consent to collect data and would be limited in what types of data they could collect. Not only does this practice protect the rights of individuals, but it also helps organizations minimize risks and liabilities by ensuring that each data processing activity has a lawful basis and specific purpose.

GDPR Compliance Checklist

Checklists can help an organization ensure that it hasn’t missed any critical elements during an audit. Creating a GDPR compliance checklist is an invaluable step in ensuring that all regulatory requirements are met and that no critical elements are overlooked during the audit process. Checklists serve as both a road map for the initial steps of becoming compliant and a measure for ongoing compliance measures. Following that, the checklist usually breaks down GDPR’s key principles and provisions into actionable items. For instance, under the principle of “lawfulness, fairness, and transparency,” items on the checklist could include establishing lawful bases for data processing, drafting clear and transparent privacy notices, and setting up mechanisms for obtaining and recording consents.

Regular reviews and updates to the checklist are necessary for maintaining compliance, especially in a rapidly evolving digital landscape. Creating and following a detailed GDPR compliance checklist demonstrates a proactive approach to data protection and serves as documentary evidence of an organization’s commitment to compliance, which can be particularly useful if regulatory scrutiny ever occurs.

Gap Analysis

The foundation of strong enterprise risk management lies in an organization’s ability to perform a gap analysis, which is an evaluation of existing policies and protocols, identifying weaknesses and areas that might not align with global data security and privacy standards. As international regulations evolve, organizations must be agile, adjusting their policies to ensure they remain in compliance with frameworks such as GDPR, CCPA, HIPAA, and others. The ability to evaluate and adapt to these global frameworks is more than just a legal necessity; it’s a strategic move that can enhance a business’s reputation and consequently its ability to gain and maintain consumer trust.

Risk Assessment

The process of identifying potential risks that could negatively impact an organization’s assets and business operations and evaluating potential negative outcomes and the likelihood of them occurring is called risk assessment. Every data processing activity carries a level of risk, which must be assessed and mitigated. One of the most comprehensive ways to conduct a risk assessment in the context of GDPR is to perform a data protection impact assessment (DPIA). A DPIA is a structured analysis that maps out how personal data are processed and how to minimize the data protection risks to individuals. It often involves evaluating the necessity and proportionality of the data processing activities and requires consultation with relevant stakeholders, including data protection officers (DPOs) and potentially even the data subjects themselves.

For example, an organization would need to conduct a DPIA when changing how user data are shared with third-party apps. This would involve scrutinizing the types of data being shared, the potential risks of this sharing to user privacy, and the measures that could mitigate these risks. They would assess whether the data sharing is necessary for the service to function or whether less intrusive methods are available. Moreover, the DPIA would investigate security measures to ensure the third-party apps have adequate protections in place. After identifying and quantifying risks, the organization then needs to establish measures to mitigate them. These could range from technical solutions such as encryption and access controls to policy measures such as stricter consent requirements or limitations on data sharing. This step also involves determining the residual risks, or the risks remaining after mitigation, to ensure they fall within acceptable levels.

Finally, GDPR requires that risk assessments are not a one-time activity. Risks need to be periodically reviewed and updated, especially when there is a significant change in data processing activities or when there are new insights into potential vulnerabilities and threats. Conducting regular risk assessments and DPIAs demonstrates an organization’s commitment to data protection, and it’s also a key requirement for GDPR compliance.

New Policies and Protocols

The first step involves creating new policies that align with GDPR requirements. For example, this might mean overhauling the company’s existing third-party data sharing agreements to include more explicit consent mechanisms. When Facebook was faced with this need, it introduced a “Privacy Checkup” tool that serves as a proactive measure to empower users to control their personal information and privacy settings.³⁰

This feature guides users through a step-by-step process to review who can see their posts, what kind of personal information is visible to others, and what apps have access to their data. Not only does the Privacy Checkup tool allow users to understand and configure their settings, but it also aligns with Facebook’s obligation under GDPR to make data collection transparent and easily understandable. By implementing such a tool, Facebook is also demonstrating accountability—another key GDPR principle—as it shows the company’s active efforts to help users manage their privacy. Table 6.6 provides some examples of new or updated policies an organization might introduce after an audit of GDPR compliance.

Legal and Internal Reviews

Any new policies must undergo a legal review to ensure they are compliant with GDPR standards. They should also be vetted by different departments within the organization to check for feasibility, practicality, and effectiveness.

• Legal review for GDPR compliance: Before any policy is finalized, it needs to be reviewed by legal experts specializing in data protection and compliance. For instance, Microsoft undertook a comprehensive legal review when GDPR was introduced to ensure all its products and services were complying.³¹
• Departmental review for feasibility: Once the legal review confirms the draft policies follow GDPR, the next step is to vet them through the various departments that will be impacted. Each department can give insights into how practicable the new policies are. For example, when Salesforce implemented new privacy policies, it engaged multiple departments, including marketing, sales, and customer service, to ensure operational feasibility.³²
• Executive approval for effectiveness: The final arbiter in the review process is typically the executive leadership of the organization. Its buy-in is critical not just for approval, but also for the effective implementation of the policies. Amazon’s leadership, for example, plays an active role in the review and approval of compliance policies, as evidenced by the company’s public corporate governance guidelines.³³

Employee Training

Employees need to be educated about any new policies to ensure company-wide compliance. Training sessions, workshops, and regular updates can serve this purpose. Educating employees about new policies is critical for ensuring that the entire organization adheres to compliance standards. This involves a comprehensive and sustained effort, involving multiple training formats and ongoing updates such as those listed in Table 6.7.

Policy Implementation

Implementing new policies to align data handling practices with GDPR requirements turns assessment findings into actionable practices. For example, if gaps in consent management are identified, systems should be updated to ensure explicit opt-ins and proper recording of user consent. Similarly, if high-risk activities are found, the organization might introduce measures such as encryption or stricter access controls. Effective implementation often requires coordination across multiple systems and departments, ensuring that changes are consistent and integrated throughout the organization. Table 6.8 gives some examples of implementation strategies a company might use.

Communication

Once new policies are in place, communicating these changes to end users is critical. This could occur via emails, updated terms of service, or in-app notifications, for example. Transparent and timely communication with end users is key to maintaining trust and ensuring that new policies are understood and followed. Here are three ways an organization can communicate these changes effectively:

• Email notification: An organization can distribute a comprehensive email to all users, providing an executive summary of what changes have been made in the data privacy policy, why these changes were necessary, and what users need to do, if anything, in response. The email should also provide a link to the updated full text of the policy for those who desire to review it in detail. This also includes positive receipt of notification indicating the changes to the policy have been read. An example of such a transparent approach can be found in the way Dropbox communicated its privacy policy changes in 2023.³⁴
• In-app pop-up: Another effective way of ensuring the message reaches the user base is through an in-app pop-up notification. This notification can appear when users log in to the app after the policy changes have been enacted, offering them a brief overview of the changes, and directing them to more detailed information. X (formerly Twitter), for instance, employed this strategy when the company updated its terms of service in 2023.³⁵
• Social media announcements: In addition to email and direct communication through the platform, leveraging other social media channels to announce changes can also be useful. A series of posts explaining the key changes in easy-to-understand language can be made on platforms such as Instagram, LinkedIn, or X to broaden the reach. Google took to its blog and social media to explain changes when the company updated its privacy policy in 2020.³⁶

Continuous Monitoring and Auditing

Continuous monitoring and auditing are vital in ensuring that the changes implemented are not merely a one-time fix but are effectively integrated into an organization’s ongoing operations. This involves conducting a mix of automated and manual reviews aimed at regularly validating an organization’s compliance with GDPR. Establishing a schedule for routine audits and assessments is key, as it provides structured intervals for scrutiny, which in turn minimizes the risk of noncompliance creeping back into the organization’s practices over time.

Table 6.9 describes the actions needed to monitor and audit data handling and who is responsible for each action; it also features time frames for the implementation of each task.

Case Study: Facebook Gap Analysis, Risk Assessment, and Policy Changes

One real-world example that highlights the need for robust data security and privacy protocols involves the gaps that surfaced in the policies of Facebook (now Meta) during the Cambridge Analytica scandal. In March 2018, it was revealed that the data of around 87 million Facebook users had been harvested without consent by a third-party app and sold to Cambridge Analytica, a political consulting firm. The incident sparked global outrage, leading to intense scrutiny of Facebook’s data privacy practices, and eventually resulting in significant regulatory action.

This case study explores the processes enacted during Facebook’s audit, gap analysis, risk assessment, and policy development and implementation.

Facebook’s approach began by identifying the scope and objectives of its audit. The focus was on how management could address the challenges and gaps in its data privacy practices to align with global standards. The scope was to examine how Facebook’s failure to protect user data led to unauthorized access by Cambridge Analytica, exposing significant flaws in data management and user privacy. The primary objective was to bring Facebook’s data privacy policies into compliance with global standards such as GDPR, ensuring management’s responsibility for implementing necessary changes.

Facebook conducted a detailed examination of existing policies, with a critical eye toward identifying vulnerabilities and areas for improvement. Although the pre-incident policies that allowed third-party apps to access Facebook users’ data were compliant with existing laws, they were found to be risky. This situation highlighted the importance of not only complying with legal requirements, but also adhering to privacy best practices to protect users’ personal information.

The next phase involved comparing Facebook’s practices to the stringent requirements of the EU’s GDPR. GDPR emphasizes principles such as data minimization and transparency, both of which were lacking in Facebook’s existing data sharing approach. The principle of data minimization ensures that organizations only collect, process, and store the minimum amount of personal data necessary for its purpose. Identifying specific areas where compliance with international standards was lacking underscored the need for targeted interventions.³⁷

Next was the process of identifying gaps and weaknesses which involved a meticulous examination of areas where policies, procedures, and practices fell short. This step pinpointed specific areas that needed to be addressed to enhance data protection and user privacy. In the case of Facebook, the company conducted an audit and found gaps in its own user consent management, data sharing controls, and third-party data access monitoring. It then laid out a plan to address these areas systematically.

Risk evaluation considers potential negative consequences resulting from gaps and weaknesses. For Facebook, the risks included substantial regulatory fines (such as a $5 billion fine by the FTC), potential reputational damage, and the loss of user trust. For any organization, understanding these risks is essential in prioritizing and tailoring the response to ensure that the most significant threats are addressed promptly.

Based on the identified gaps and assessed risks, Facebook needed to develop clear and actionable plans to rectify its shortcomings. This included implementing changes to limit third-party access, which is access to data from an external entity to user data, enhancing user consent mechanisms, and increasing transparency regarding data usage.

The implementation phase is where planned changes are executed. Facebook, in response to heightened data privacy concerns, began to conduct more robust audits of third-party developers, enhancing oversight and adhering to stricter data privacy standards. To ensure these changes were not just one-off adjustments but part of a sustained compliance strategy, Facebook instituted continuous monitoring measures. These measures include regular reviews of data access and usage by third-party developers, the use of advanced analytics to detect and respond to unusual patterns indicative of potential data misuse, and ongoing updates to their data privacy policies and practices in line with evolving regulations and user expectations. Continuous monitoring of compliance ensures that the changes not only effectively address identified gaps, but also that ongoing compliance is maintained, adapting to new challenges and regulatory requirements as they arise.

Documenting and reporting are final steps that are vital in maintaining transparency and trust. Facebook increased transparency with users and regulators through public reports and regular updates on privacy measures, reinforcing the importance of management’s role in driving these changes.

Facebook’s reevaluation of its data security and privacy policies after the Cambridge Analytica scandal illustrates the process of aligning corporate practices with global standards. It also serves as a lesson for organizations to be vigilant in protecting user privacy, ensuring compliance with regulatory frameworks, and establishing transparent communication with stakeholders.