GDPR assessment of policies and procedures for cloud data platform

Service description

As organisations move their data to the cloud, previous efforts for GDPR compliance will require review. This assessment, delivered by workshops and questionnaire, identifies gaps to policies and procedures which have appeared due to innovation, additional PII, new data types and volumes. The assessment is concluded with a report submission.

Service features

Assessment of leadership and oversight (DPO) for cloud data PII

Assessment of policies and procedures for cloud data PII

Assessment of training and awareness for cloud data PII

Assessment of individuals' rights (DSARs) for cloud data PII

Assessment of transparency and privacy for cloud data PII

Assessment of ROPA and lawful basis for cloud data PII

Assessment of contracts and data sharing for cloud data PII

Assessment of risks and DPIAs for cloud data PII

Assessment of records management and security for cloud data PII

Assessment of breach response and monitoring for cloud data PII

Service benefits

Key deliverable: completed GDPR gap analysis spreadsheet with responses

Key deliverable: written report with recommendations for GDPR next steps

Price certainty: based on scope and complexity of cloud PII

Customer trust: promoting transparency, availability, security, integrity of cloud PII

ICO guidelines: aiding compliance of policies, procedures and cloud PII

Risk management: helping close gaps which have appeared since 2018

Data privacy strategy: provides inputs and insights for roadmap

Supply chain confidence: business partners more willing to share data

Better information governance and security: practices will aid ISO27001

Agnostic: valid for Azure, AWS, GCP, Snowflake, Databricks and more

Service planning

Moving data to the cloud brings many new opportunities for innovation. Additional data sources, digital services, emerging AI and Machine Learning, and data sharing, are all likely to challenge any existing GDPR compliance which may not have been reviewed since 2018. It is essential that before embarking on or further developing cloud data initiatives, a review of existing GDPR processes and policies takes place to understand new gaps which will appear when cloud data platform is considered. The GDPR assessment will have a fixed price, offering price certainty. The size and scope will depend on:

Scope of PII and organizational functions supported by cloud data platform

Availability and collaboration with existing DPO function

Sensitivity of PII, knowledge of data use cases and complexity of cloud data infrastructure

The GDPR assessment should be planned beforehand to agree the scope, size and specific objectives. Organisational resources will need to be made available particularly within the DPO as well as existing GDPR/data privacy documents, artefacts and tools. NWorld would seek to have an initial planning meeting with the requesting organisation.

The duration and cost will depend on the factors above, but typical is 8-20 man days.

A pre-cursor to data migration to the cloud data platform

Where there is personal identifiable information (PII) thought to be moving to the cloud, it is a legal requirement that organizations meet GDPR and the Data Protection Act 2018. Failure to do this or suffering data breaches can lead to large fines and poor publicity. The GDPR assessment is a prudent investment prior to moving PII to the cloud or innovating with new cloud capabilities such as AI, Machine Learning, automated decisioning or sharing data with business partners or citizens. It will highlight gaps in GDPR processes and policies which were not apparent prior to cloud migration or new cloud innovation.

Service constraints

In a cloud environment, the responsibility for GDPR compliance is usually a shared responsibility between the organisation and the cloud data platform provider. NWorld will provide the assessment, the gap analysis, a compliance roadmap if required and further support to help meet the roadmap (but this is follow-on scope.) The responsibility for compliance is and must remain with the organisation's DPO. NWorld will work as an advisor or trusted friend. NWorld's offering is policy, process and data led - for the cloud. NWorld do not cover the legal aspects or advice of GDPR.