Due to the interdisciplinary nature of the GDPR (combining knowledge from fields such as law, information technology, business continuity, and crisis management), it often turns out that the available human resources do not guarantee the success of the planned project. Organizations then face a difficult question: who can help us implement the GDPR?
Choosing a reliable partner can be challenging, especially as the date of May 25, 2018, approaches, with more companies offering services related to GDPR implementation support. How, then, should one select an effective consultant (advisory firm)?
Key elements to consider.
1. Experience in personal data protection
The GDPR, unlike current regulations, does not contain a ready-made checklist of obligations to be "ticked off." After May 25, 2018, each organization will independently decide, among other things, how often to change passwords for IT systems, what procedures will be included in the security policy, and how to secure mobile devices used for work.
Effective implementation of GDPR requirements within an organization is guaranteed by a specialized entity with appropriate experience in designing, implementing, and maintaining personal data protection systems. An experienced advisory firm is capable of recommending adequate and cost-effective data protection measures.
2. Interdisciplinary team of experts
The "GDPR 2018" project is a team effort, carried out on several levels - managerial, legal, and IT. The multi-layered nature of the changes means that a professional advisory firm supporting the GDPR implementation process must have an interdisciplinary team of experts with competencies confirmed by certifications, including in the fields of law, information security management, IT services, business continuity, and crisis management.
Even the best specialist alone cannot prepare an organization for GDPR compliance.
3. Work methodology
The "GDPR 2018" project involves a significant amount of human work, making proper planning crucial. A professional advisory firm supporting GDPR implementation must provide a recognized project management methodology (compliant with, for example, PRINCE2, COBIT, SCRUM) necessary for timely and effective implementation.
Intuitive project management leads to extended implementation time, increased project costs, often discouraging participants from working, and frequently resulting in failure.
4. Scope of support during implementation
The GDPR requires organizations to engage in building their own personal data protection system, appropriate to the profile of their activities. The implementation of the GDPR provisions can be likened to the construction of an information security management system compliant with ISO/IEC 27001. A professional consulting firm provides support at each subsequent stage of implementation, namely:
- introducing management to the implementation process,
- workshops for the implementation team,
- assessing the organization's readiness to apply the GDPR (opening audit),
- conducting a risk assessment process,
- conducting Data Protection Impact Assessments (DPIA),
- adapting business processes,
- planning the adaptation of the IT environment,
- developing dedicated personal data protection documentation,
- training personnel,
- verifying the organization's preparedness to apply the GDPR (closing audit).
5. Project Duration
Preparing an organization to apply the GDPR requires time and depends on a number of factors, including the size of the organization, previous actions taken regarding personal data protection, and the awareness and commitment of top management. Due to the complexity of the GDPR implementation project, its duration ranges from several to several months. A consulting firm undertaking assistance in implementing the GDPR should methodically estimate the time needed for project execution (e.g., using the PERT methodology) and monitor progress in its implementation (e.g., using a Gantt chart).
6. Price
Every organization strives to achieve maximum effect with minimal resource expenditure; therefore, price is a significant criterion for selecting a consulting firm. However, when choosing a partner, it is essential to check which elements of the implementation are covered by the proposed price and whether there are any additional fees. The proposed collaboration should encompass the adaptation of all data processing activities carried out by the organization, not just a part of them.
