Photo credit: Ivan Marc/Shutterstock.com

K Royal is in the business of making sure companies are compliant with the European Union's General Data Protection Regulation. As senior director of privacy at compliance and security company TrustArc Inc., she helps organizations bridge the gap between knowing they must fully follow the GDPR, and actually crossing the finish line.

“I've worked with startups to global companies who are established in every country,” Royal explained. “The most common factor was that the companies did not know what data they have and where it is stored.”

The GDPR, which came into effect on May 25, adds so many new requirements for companies that deal with European Union citizens' personal data, that being able to locate it all is important. The law requires for instance, that companies report a breach to authorities within 72 hours and gives individuals the right to request data held on them and to have their data deleted.

Luis Diaz, the general counsel and chief cybersecurity officer of Vision-e, had spent 10 years working as the outside counsel for the company while he was a partner at Gibbons P.C. In September 2017, the software company faced the challenges of becoming compliant with the GDPR and appointed him as the top legal officer to help with that process and work on other cybersecurity issues.

Diaz said that when he started working at Vision-e, he and his team had to create the company's first data maps. The first step was make sure the company knew what kind of data it had and where it was stored. Which was, according to Diaz, quite the undertaking.

“It was a manual process for us working with IT. There are tools available but we choose to collaborate with IT to ensure we did not miss anything. It took thousands of man hours to complete,” Diaz said.

He said they needed to understand what kind of design they were implementing, what controls they had in place and to make sure they understood the nature of their data and where consumer data was coming from.

Diaz said Vision-e is working to continually improve their processes and will hopefully be able to employ artificial intelligence in the future to do the mapping.

While many companies may have not taken GDPR preparation seriously, Diaz said the executives at Vision-e understood the urgency behind compliance.

“In our particular case, because we are a 'processor' of data, it was clear that we had no choice but to be GDPR compliant,” Diaz said. “It was a business decision which was strategic to our future.”

Diaz thinks businesses will even tout their GDPR compliance in the near future. “Don't be surprised if in the next six months to a year you find people pointing to GDPR for a competitive advantage. It has raised and created an awareness for privacy issues,” he said.

Royal said that in her experience nearly all of the companies she has worked with were cooperative and willing to make changes to become GDPR compliant.

However data mapping has been an obstacle for her on one occasion. She said that with one company she worked with, which she declined to name, she was trying to help the organization map its data for GDPR compliance purposes. But she found the IT department would not let her begin the process and have the access to systems that she requested.