12th july gdpr event slides

#GDPREXPO

WELCOME TOTHE HILTON HOTEL

ARE YOU READY FORTHE CHALLENGE OF GDPR?

AGENDA 11:30 - 12:00 Arrival & Registrations.

12:00 - 12:20 Welcome & Introduction to Exponential-e: Lee Wade - CEO & Founder, Exponential-e.

12:20 - 13:00 Are you ready for GDPR? Neil May - Director of Technology Risk Management, Newable.

13:00 - 13:15 Break.

13:15 - 13:45 GDPR: Gap Analysis & Remediation Plans:Neil May - Director of Technology Risk Management, Newable.

13:45 - 14:15 GDPR and Data Security:Jeff Finch - Head of Security Services, Exponential-e.

14:15 - 14:40 QA & Panel Discussion.

14:40 - 15:00 Lunch and Networking.

#GDPREXPO

ARE YOU READY FORTHE CHALLENGE OF GDPR?

LEE WADECEO & FOUNDER, EXPONENTIAL-E.

www.exponential-e.com

GDPR OVERVIEW

GDPR Overview

• GDPR is a long-overdue upgrade to the existing Data Protection Act 1998

• Fundamentally, businesses need to be more transparent about the personal data they hold; why they captured it and what they intend to do with it

• The concept is simple: if I have given you my data, then I should be able to retrieve it or even transfer it to someone else

• Companies who do not handle this data in line with the new rules could be faced with a hefty fine of up to 4% of its global annual turnover, or €20,000,000, whichever is more . . .

• And that’s not all. Businesses that don’t comply risk legal action from the individuals whose personal data they are using, since GDPR gives EU residents direct rights to obtain court orders and compensation

http://www.exponential-e.com




CONNECTIVITYSERVICES

10GigE Business Internet, SD-WAN,

BandwithManagement,

Cloud Connect, Superconnected Cities,

Software Defined Networking

CLOUD SERVICES

Cloud for Enterprise, Cloud-Network

solutions,Desktop-as-a-Service, DaaS GPU, Workplace Recovery, IaaS (VDC),

Server Replication, Online Backup,

Enhanced Analytics & Big Data, Object &

HDFS Storage

VOICE & UNIFIED COMMUNICATIONS

Hosted PBX, Smart Audio Conferencing,

Inbound Call Management, SIP

Trunking, Call Recording.

DATA CENTRE SERVICES

Enterprise-class Colocation, Managed

Colocation, Shared Colocation, Smart

Hands

SERVICE PORTFOLIO

MANAGED IT& PROFESSIONAL

SERVICES

Professional Services, Managed Services,

Digital Transformation,AWS/Azure

Management, Network Monitoring, Windows Server 2003

SECURITY SERVICES

CyberSecurity & consultancy, PEN Testing, SSL VPN , Firewall design





A SELECTION OF CLIENTS





GDPR OVERVIEW

GDPR Overview

This morning, we will cover off many questions about GDPR Compliance such as:

• Understanding the implications of GDPR

• Understanding the new obligations to achieve compliance.

• Preparing for GDPR: Discovery and Remediation plans

• What exactly is ‘explicit consent’?

• What are the implications for my data stored in my CRM system?

• What is the ‘right to be forgotten’ and what does this mean for my data?

• What does ‘pseudonymisation’ mean for all my encrypted data files?

• Will the auditors sign off my 2018 accounts if we are not GDPR compliant next year?

• Do we ALL now really need a Data Protection Officer?





GDPR OVERVIEW

GDPR Overview

• The General Data Protection Regulation (GDPR) is the European’s view on what the baseline expectations are for processing personal information of EU citizens as we continue through the digital revolution

• The GDPR introduces a raft of onerous and complex requirements and regulations

• Importantly, for the first time we will have a single set of privacy rules across EU member states, and this harmonization goes even further as the GDPR has cross-territorial implications

• It comes into force in the UK in May 25th, 2018 – And we all have a lot of work to do!

We have 317 days left to prepare for GDPR





GDPR OVERVIEW

GDPR transforms a number of existing requirements and introduces a raft of new ones.

GDPR Coalition





GDPR OVERVIEW – SIMPLE GAME PLAN

2DO AN

ASSESSMENT

Undertake a broad Data Protection Assessment of your organisation

3DO A GAP

ANALYSIS

Compliance: Where you are vs Where you

need to be for GDPR

6

DECIDE IF A DPO IS

REQUIRED

Become aware and take action! 1

TAKE ACTION

Roll out training acrossyour organisation

Create a detailed ComplianceRoadmap with clear timelines

4TRAIN YOUR

STAFF

5CREATE A

ROADMAPIf you need to appoint a qualified Data Protection Officer





GDPR OVERVIEW

COMPREHENSIVE GAME PLAN





GDPR – WHY NOW?

GDPR – Why Now?

The interdependence between data sharing and data privacy

• Companies know more about their customers than ever before. In the last 24 hours, your company probably amassed more information about customers than was conceivable a decade ago

• As consumers, we benefit from this closeness. The fitness apps that tracks our steps, the messaging apps we use to send pictures from the beach, or the telematics technology in our cars that lowers our insurance premiums

• When we use our iPads and smart phones there is often an assumed understanding: we’ll give you our data/information in exchange for that excellent service or product that makes our lives easier, richer and sometimes cheaper. This is the trade-off at the heart of the digital economy

• But there are limits to this trade-off. People are increasingly aware that companies are collecting, using, retaining and sharing their information - including buying and selling it! And they are growing uneasy . . .





GDPR OVERVIEW

THE DRIVE TOWARDS DATA PRIVACY


• But our willingness to share our personal information varies dramatically according to gender, age, wealth, nationality and education . . .

• More than 50% are willing to share information about gender, ethnicity & education whilst less than 20% are willing to share their income, location, medical records or address.

• Surveys reveal that 43% of people are uneasy about smart meters in their homes

• Many people in all countries are concerned about wi-fi data analytics and web-browser spying

• In spite of our ‘uneasiness’ in the way corporates are utilizing our data, personal data is the fuel of the digital future and the enabler of disruptive technologies






• Hence, GDPR marks a fundamental shift towards the view that PRIVACY must be at the forefront of organizations’ minds when dealing with our personal data

• It is the most comprehensive attempt to define a coherent regulatory framework for privacy. Governments around the world are sharpening their focus on the issue and introducing legislation to offer greater protection to consumers — and far harsher penalties for violations

• Hence, companies need to consider a new attitude to privacy—and they need to do it quickly to minimize the risks to their balance sheet and their reputation

• GDPR CATAPULTS PRIVACY towards the top of organizations’ risk radars

GDPR OVERVIEW

THE DRIVE TOWARDS DATA PRIVACY





PREPARING FOR GDPR

ICO CHECKLIST SUMMARY

1. Awareness (Raising awareness throughout the organisation) 7. Explicit consent (Needs your urgent attention now)

You should review NOW how you seek, record and manage consent

and whether you need to make any changes.

2. Review the information you hold – (Data Discovery) 8. Children (Extra measures if you process child personal data)

3. Review the current privacy notices you send 9. Data breaches (Must be reported within 72 hours)

4. Individual Rights 10. Data Protection by Design – (Promotes Privacy & Data Protection)

Check your procedures to ensure they cover all the rights

individuals have, including how you would delete personal data or provide 11. Data Protection Officer (Do you need one?)

data electronically and in a commonly used format. 12. International – Cross – border trading checks

The main rights for individuals under the GDPR will be:

• the right to be informed;• the right of access;• the right to rectification;• the right to erasure;• the right to restrict processing;• the right to data portability;• the right to object; and• the right not to be subject to automated decision-making including profiling.

5. Subject Data Requests (Will be 30 days)

6. Lawful basis for processing personal data





PREPARING FOR GDPR

ICO CHECKLIST SUMMARY

ICO: GDPR Preparation Recommendations – 12 Point Checklist Available at:https://ico.org.uk/media/1624219/preparing-for-the-gdpr-12-steps.pdf





GDPR COMPLIANCE

GDPR Compliance

• Although we only have 317 days - DON’T PANIC!

• The burden of compliance may be less onerous if you are ISO 27001/9001 or FCA accredited. Processes may already exist for data privacy, disclosure, retention and management

• Many companies already employ Data Protection or compliance personnel

• Finally, Exponential-e & Newable can help guide you through the entire GDPR compliance process

starting with your Data Discovery and Remediation plans that Mark Childs will detail later on . . .




#GDPREXPO

ARE YOUREADY FOR GDPR?

NEIL MAYDIRECTOR OF TECHNOLOGY RISK MANAGEMENT, NEWABLE.

Building business confidence

Are You Ready For GDPR?Neil May – Director of Technology Risk Management

12 July 2017

Before we start

BREXIT

We are not off the GDPR hook. In fact, the UK will have to try extra-hard to prove Adequacy.

4 July 2017PRIVATE AND CONFIDENTIAL3

Timetable

― EU directive formally adopted 25 May 2016

― 2 year implementation period

― Becomes law on the 25th May 2018 – everyone must be compliant by then.

― DCMS is still working on the UK legislation!

PRIVATE AND CONFIDENTIAL4 4 July 2017

The ‘New Y2K’

― An immovable deadline

― A technical deliverable

― A skills shortage

― Cue – PANIC in the boardroom

― Beware the snake oil salesmen


Beware

― No quick fixes

― If it seems to good to be true…..

― It is not possible to be ‘compliant’ yet – you can at best be ‘ready’

― Over 50 Articles yet to be fully defined


But – good news for IT!

― GDPR – the business finally has to accept ownership of its data

― It is no longer “IT’s problem”


General Data Protection Regulation

― Establish a single, pan-European law to replace the current inconsistent patchwork of national laws

― Modernize the principles enshrined in the 1995 Data Protection Directive

― Immature internet

― No “cloud”

― No Facebook, Twitter, etc.

― No smartphones

― But, new principles much the same as the old ones


Benefits of the new Regulation

― Benefits for organisations

― One EU market, one law

― One-stop-shop – a single supervisory authority

― Same rules for all organisations

― Even those outside the EU

― Benefits for EU citizens

― Better data security

― Putting people in control


Some definitions

― More personal data covered (e.g. IP addresses; URLs)

― 'Pseudonymised data' is personal data

― Sensitive personal data extended (genetic, biometric, sexual orientation)

― Manual records extended (structured or unstructured)

― Main establishment and one stop shop: likely to involve a "concerned supervisory authority"

― Issues resolved at the European Data Protection Board


Data processing activities

― No requirement to notify ICO

― Data Controllers and Data Processors must keep a record of their processing activities

― Must make available to the ICO on request


Impact assessments

― Requirement to perform privacy impact assessments

― Specifically where the processing of personal data is ‘likely to result in a high risk for the rights

and freedoms of individuals’

― Eg when processing personal data through new technologies or when engaging in people

profiling


Impact assessments

― If assessment reveals that processing of personal data would result in a high risk (eg due to the absence of mitigating controls), data controllers will be required to consult with the ICO

― If the ICO believes that any processing of personal data would be non-compliant with the Regulation then:

― Advise data controller on how to proceed

― Require an organisation to undergo a data protection audit


Consent

― Consent given by data subjects must be “unambiguous” for all processing of personal data

― Requires a “clear affirmative action”

― Consent has to be “explicit” for sensitive data

― Silence, pre-ticked boxes or inactivity does not constitute consent

― Must have an audit trail

― List brokers?


Right to be forgotten

― Data subject has the right to have his or her personal data erased where the retention of data breaches the regulation

― The right to erasure does not provide an absolute right to be forgotten

― Data Controller and Processors have an obligation to ensure that any third party with whom data is shared also erase the personal data unless it is impossible or involves disproportionate effort to do so


Data

Subject

Liability

― Data controllers and data processors have shared liability

― Even more important to have proper contractual arrangements in place

― Processors as well as controllers must provide a security level “appropriate” to the processing risks

― Risk assessments for each customer

― Varying standards of data security for different

types of processing


Data Protection Officer

― Mandatory appointment of a DPO for

― Public authority or body

― Those who monitor data subjects on a large scale

― Core activities process sensitive personal data

― ICO says so!

― Can be outsourced

― Must be…

― involved in all issues which relate to the protection of

personal data

― provided with necessary resources to perform their

required tasks


Data Protection Officer tasks

― To inform and advise the data controller, data processor and their employees of their regulatory obligations

― To monitor compliance with the Regulation. Including…

― Policies

― Assignment of responsibilities

― Raising awareness and training of staff

― To provide advice, related to data protection impact assessments and to monitor impact assessment performance

― To cooperate with the ICO

― To act as the contact point for data subjects and the ICO


Data Protection Officer position

― The Data Protection Officer must not receive any instructions regarding the exercise of these tasks

― Independent, whether or not an employee

― They shall not be dismissed or penalised for performing their tasks

― The Data Protection Officer shall directly report to the highest management level of the controller orthe processor


Data breaches

― ICO must be notified within 72 hours of becoming aware of the breach

― Where this cannot be achieved within 72 hours, an explanation of the reasons for the delay

should accompany the notification and information may be provided in phases without undue

further delay

― The notification must at least…

― Describe the nature of the breach

― Communicate the name and contact details

of the Data Protection Officer or other

contact point where more information can

be obtained


Data breaches

― Fines for unprotected data breaches will range up to €20 million or 4% of annual global turnover (whichever is higher!)

― If you suffer a breach and can show that the personal data can't be accessed by unauthorized people (e.g. it was encrypted):

― The likelihood of being fined should be very greatly reduced

― You won't need to notify affected data subjects of the breach


Data portability

― Where processing of personal data is carried out by automated means, the data subject should be allowed to receive their personal data in a structured, commonly used, machine-readable and interoperable format and transmit it to another controller.

― The data subject has the right to request that the data is transmitted directly from controller to controller where technically feasible.


Contacts

Data protection by design

― Data protection must not be treated as an afterthought or ignored altogether

― Consider when…

― Building new IT systems for storing or

accessing personal data

― Developing policy or strategies that

have privacy implications

― Embarking on a

data sharing initiative

― Using data for new

purposes

PRIVATE AND CONFIDENTIAL41

Portfolio

Service

4 July 2017

Contacts

Data protection by design

― Potential problems are identified at an early stage, when addressing them will often be simpler and less costly

― Increased awareness of privacy and data protection across an organisation

― Organisations are more likely to meet their legal obligations

― Actions are less likely to be privacy intrusive and have a negative impact on individuals

PRIVATE AND CONFIDENTIAL42

Portfolio

Service

4 July 2017

Codes of practice

― Codes of practice (or "codes of conduct" to use the correct Regulation-speak) become more important

― If one DP authority produces a code of practice it can be more or less adopted in other countries

― European Data Protection Board has a role


Codes of practice

― In the UK there are already Codes of Practice in areas such as Marketing, CCTV, Human Resources, Direct Marketing, Subject Access, Privacy Impact Assessments, Personal Information Online and Data Sharing

― Aligning data protection procedures now with the content of ICO Codes of Practice should get you ahead of the field


Suggested Codes of Conduct

― Processing in the data controller's legitimate interests

― Consumer rights & dispute resolution procedures

― Fair data collection and transparency re data processing

― Pseudonymisation of personal data

― Exercise of their rights of data subjects

― Protection of children

― Security of processing and data loss

― Transfers of data to other countries


What to do now?

― Be compliant with the DPA 1998!

― Know what personal data you process

― Data permeation maps

― Where does the data come from?

― What do we do with it?

― Where does it go?

― Information asset inventory


What to do now?

― Ensure policies and procedures are up to date and relevant

― Review information security arrangements

― In processing personal data, be

― Fair

― Transparent

― Understand your basis of data processing!


#GDPREXPO

GDPR: GAP ANALYSIS& REMEDIATION PLANS:NEIL MAYDIRECTOR OF TECHNOLOGY RISK MANAGEMENT, NEWABLE.

Building business confidence

Gap Analysis and Remediation Plans

Neil May – Director of Technology Risk Management

12 July 2017

Why do you need a Gap Analysis

― The GDPR contains 99 articles

― Article “a separate clause or paragraph of a legal document or agreement, typically one outlining

a single rule or regulation”

― The GDPR contains 173 recitals

― Recital “the part of a legal document that explains its purpose and gives other factual information”

― Do you think you have the capability to successfully interpret all of these on your own?


There is a lot of rubbish talked about GDPR!

― If somebody tells you they can make you GDPR compliant they simply aren’t credible!!

― The GDPR will be enforced from May 2018 and is now well into the implementation period

― EU member states are able to vary aspects of the GDPR even though it is a Regulation, designed

to harmonise data protection law. These parts that can be varied are known as derogations

― The Department of Culture, Media and Sport (DCMS) who run the consultation said: “The UK

pressed hard throughout negotiations to ensure that the GDPR does not place unnecessary

burdens on business. There are also derogations (exemptions) within the GDPR where the UK

can exercise discretion over how certain provisions will apply.”

― An example of a derogation in the GDPR is the age of consent for children, which can be set

between 13-16 years old. It is up to a member state to decide and this consultation will address

these questions


NO YOU WON’T!!!!!

So where does that leave us?

― There are still 50 articles that the DCMS needs to ratify.

― Well on the basis I’ll wait then…..


The Act comes into force May 2018!!

― All countries in the EEA will need to be fully complaint with all of the requirements at this time

― Failure to do so and you are risking considerable fines and reputational damage to your business

― The current fines regime is set at €20 million or 4% of your annual global turnover, whichever is

the higher

― Countries who process European Subjects data are not exempt

― For example, if you have offices in the Middle

East and process European Subject Data you

are “in-scope”


So what does a Gap Analysis look like?

― There is no such thing as a “typical gap analysis”

― All organisations are different so the duration required to perform one ranges from days to weeks to months depending on size, complexity etc.

― So where do you start?

― Do you understand your “Data Estate”?

― Are you able to evidence this?

― Do you have an Information Asset Inventory?


― Do you have a record of all of your 3rd Parties who process

personal data on your behalf?



So what does a Gap Analysis look like?

― So where do you start?

― Have all of your staff including contractors, part-time, volunteers etc. received Data Protection

Awareness Training and do they receive this on a regular basis?


― Have you received unambiguous Positive Consent from all of your Staff, Clients etc.as to how

you intend to process their data?


― Have you received unambiguous Positive Consent from all

of your clients held on your current CRM system(s) as

to how you intend to process their data?



Should I be concerned?

― If you aren’t then you should be!!

― GDPR is probably the single most ground breaking piece of legislation that has come into force in the past 20yrs

― The Gap Analysis is just the start of it. This will:

― Identify as to where you are and aren’t complaint with the proposed GDPR

― It will provide you with a set of Data Permeation Maps,

which map your respective personal data flows in the

business; this will include both Logical and Physical

data namely your Data Estate

― It will provide you with an indication of the effort

required to bring yourself to being GDPR ready

― So what's next?


Remediation plans

― Please don’t underestimate the time you will require for remediation

― GDPR came into force in May 2016 and you have until May 2018 to be compliant

― 2 years is probably a reasonable estimate as to how long it would take the average business to perform a gap analysis and put in place controls and measures, to demonstrate that they were GDPR ready

― No matter what the size or complexity of your organisation GDPR will have an impact on how you do business

― Unfortunately most businesses have significantly underestimated the impact of GDPR or are simply in denial!


Remediation plans

― Lets start with some good advice. As a minimum you will need to consider:

― Data Permeation Maps

― Data Inventory

― Data Protection Officer

― Data Protection Training and Awareness

― Data Protection Policies and Procedures

― Third Party Assurance Programme

― Third Party Contracts

― Penetration Testing and Vulnerability Analysis


Remediation plans

― Lets start with some good advice. As a minimum you will need to consider:

― The Right To Be Forgotten

― Subject Access Requests

― Privacy by Design

― Privacy Impact Assessments

― Positive Consent

― CRM Systems

― CCTV

― Data Portability

― Cross Border Transfers


What to do now?

― There is no time like the present:

― Get yourself a copy of the GDPR

― Perform a Gap Analysis

― Produce a Remediation Plan - You have less than a year to get yourself GDPR ready

― Do not underestimate the time and effort required - YES it is going to cost ££s so budget for it.

― Ignore it at your peril!!! Compliance is not an option – this is the law!


#GDPREXPO

GDPR &CYBER SECURITY

JEFF FINCHHEAD OF SECURITY SERVICES

www.exponential-e.com #GDPREXPO

CYBER SECURITY BY DESIGN

• GDPR, Articles 25, 32, 33,34, and 35 contain details on securing data

• The Top Five

• Discover the weaknesses

• Privacy by Design = Security By Design

• Security Appropriate to Risk

• The Principle of Least Privilege

• Better Control of Customer Data

• How can we support you?


DISCOVER THE WEAKNESSES

• The world of self denial!

• Your own audit will not find it!

• Independent assessment of where you are.

• Exponential-e provide access to trusted renowned partners in this field.

• Pen Test Partners LLP.

• We facilitate! Its the customers report!

• And they are accredited.


PRIVACY BY DESIGNSECURITY BY DESIGN

We take Security Seriously:

• All our Solutions Engineers are trained to High Standards.

• Platinum Partner with Fortinet.

• MSP Partner Palo Alto.

• Gold Partner for Gemalto / Safenet.

• Senior Partner for Foresite.

• Only MSP Partner for Sentinel One.

• We design based on the solution you need.

• Our Partners ensure we are well trained.


SECURITY APPROPRIATE TO RISK. THE PRINCIPLE OF LEAST PRIVILEGE.

• How do you judge these two?

• Evaluate the risk and impose the security!

• How often do you review users privileges?

• Advanced Security Monitoring

• Log collection and correlation from any device under one pane of glass!

• Generates reports

• Has 24 x 7 Analyst support

• Alerts and advice on remediation


BETTER CONTROL OF CUSTOMER DATA

Where’s The Cloud for Exponential-e ?

• Cloud Storage is located within UK Borders.

• We Provide encryption.

• Structured Storage offering dedicated arrays.

• Which means that customers can store in a

structured, searchable, encrypted platform their

essential data which is already GDPR ready!

What does The Exponential-e Cloud provide to our Customers ?

• Information Governance.

• Configurable to meet regulatory and compliance

standards.

• Provides a Data classification application

• On Structured and unstructured data

• Regardless of where data resides (premises or

Cloud).

• Data ownership, Data retention periods, Data

Sensitivity.


A Unified Platform

Use a single platform for data governance and policy management, and extend data governance and control to cloud-based data.


A UNIFIED PLATFORM

• By knowing exactly where personal data lives across your organization, you can:

o Identify the presence of personal data in all data locations.

o Automate special handling of information with standard data policies (i.e., access control, security, encryption, retention).

o Support the export and erasure of personal data from all data sources.

o Detect and delete unneeded copies of personal data.

o Maintain an auditable chain of custody on an individual's personal data.

o Understand data leakage risk and speed up data breach analysis.

#EXPO-GDPR

THESECURITY PRODUCT

PORTFOLIO

Customer Applications

Internet

Customer Perimeter

Customer VPN / Network

Ransomware Protection

Email & Content Filter

Next Gen UTM

Pen Test & IT Health Check

DDoS Mitigation

GRC Consultancy

Advanced Firewall Monitoring

Multi Factor Authentication

Next Gen Firewall

Web & URL

#EXPO-GDPR

QUESTIONS?