Overview
The regulatory bar is being raised. With an increased focus on information security and a slew of data breaches, privacy requirements are becoming more stringent. It’s an organization’s responsibility to ensure vendors are compliant with privacy regulations such as the EU General Data Protection Regulation (GDPR).
With our Data Protection Assessment, you can easily see any data privacy risks present by engaging in business with the vendor. Each control within the assessment correlates back to relevant industry guidelines and standards addressing vendor risk and allows key decision-makers to confidently weigh threats introduced by vendors as well as respond to the resulting risks.
The primary objective of the GDPR is to give citizens back control of their personal data. If you control or process the data of EU citizens based in or outside of the EU, the GDPR will apply to you.
Under the GDPR, if your organization suffers a breach of information assets related to EU citizens, the entity would be charged heftily and would need to notify the local data protection authority and potentially the owners of the breached records resulting in loss of reputation
Phases of Consultancy
Information Flow Assessment
- Identify information sources, and is processing infrastructure that involves personnel, technology, physical infrastructure
- Roadmap to bridge the identified gaps
Privacy Impact Assessment
- What is the impact on the individual (data subject) upon a breach?
- How did this breach occur in the light of present set of security controls?
Define Management System (Reverse Engineering)
- Upgrade what you have
- A very slim set of policies, procedures, template and guideline
- Distribution of security responsibility to internal stakeholders, with controls policies and transactions that ensure regulation is well embedded in the organisation processes
Training workshop
- InfoSec Awareness
- Risk Management
- Process Owner’s training
Performance Monitoring
- What is your pain area?
- Where do you expect improvement?
- Define Performance Objective
- Derive Performance
- Analyse Trend
Program Management
- Progress monitoring
- Status overview to Management
- Continuous Record review
- Facilitation to Process Owners
Internal Audit
- Internal Audit to ensure readiness
- NC closure and trend analysis
External Certification Support
- Identify right Certification partner
- Collaboration
- Guidance for NC closure (If any)
- Be there to Celebrate Success
Related Services
ISO 27001/ISO 27002 - Information Security (ISMS)
Ensuring Information Security is defined, implemented, measured and audited in products, services and processes, resulting in business protection and successful ISO 27001 certification
ISO 27701 - Privacy Information (PIMS)
Demonstrates the businesses focus on due diligence and compliance with data protection regulatory the existing ISMS (GDPR, HIPAA, CCPA etc.)
California Consumer Privacy Act (CCPA)
It grants consumers greater transparency from companies because Personal information cannot be sold without the consent of the consumer.
Health Insurance Portability & Accountability Act (HIPAA)
Ensuring HIPAA Security Safeguards are embedded in your products, services and processes.
DPO – Data Protection Officer
Employing a virtual DPO demonstrates to the Information Commissioner’s Office (ICO) and your business partners your commitment to a data protection framework.
Internal Auditor
An internal auditor (IA) is a trained professional tasked with providing independent and objective evaluations of company financial and operational business activities.