Solution Accelerator: General Data Protection Regulation

GDPR Solution Accelerator 1 hour

Start Learning

The General Data Protection Regulation (GDPR) is considered to be the most stringent privacy and security law in the world at the heart of which is that individuals have the right to be informed about the collection and use of their data.

Privacy is key to reinforcing user trust. Our GDPR accelerator charged with example-based content will help you implement privacy by design and achieve and maintain compliance.

Our GDPR Accelerator provides Informatica Data Privacy Framework with prefilled templates to showcase how sensitive data moves across the onboarding process. We offer exercises with another tool called Data Privacy Management (DPM) to check whether sensitive data is protected. We also have Workflows that you can customize. We cover main use cases like Subject Rights Requests (SRR), Data Subject Access Request (DSAR), Right To Be Forgotten (RTBF), and Right to Rectification. With our GDPR Accelerator, you can be prepared to tackle compliance.

Overview

How this Book is Organized

60 minutes

1.2

Where to Start

GDPR Overview

2.1

What is GDPR?

2.2

Rights and Responsibilities

2.3

Challenges of Compliance and the risks of Non-Compliance

2.4

Technology makes the difference

Insights into What Data is Affected

3.1

What Falls Under GDPR

3.2

The Geographic Scope of GDPR & Taking an Enterprise-Wide Approach

3.3

Where the Technical and Business Environments Meet

Discovering the Data

4.1

Data is all over the Organization, in Silos

4.2

Discovering Data, Analyzing Risks

4.3

Intelligent Data Catalog

Manage Risk and Compliance

5.1

Overview

5.2

Technology to Handle Protection

Accelerate GDPR Journey

6.1

About the Accelerator

6.2

GDPR Journey with Reference Case Study

6.3

Define and Manage Government Policies

6.4

Components of GDPR

6.5

Sub policies of GDPR Policy

6.6

Workflow: Selection, Diagram, and Notification

6.7

Client Onboarding Process

6.8

Discover, Classify and Understand Personal and Sensitive Data

6.9

Privacy Dashboard, Protected, and Sensitive Data

6.10

Map Identities

6.11

Analyze Data Risk, and Establish Protection Plans

6.12

Policy Overlays and Workflow Approval

6.13

Risk Simulation Plans

6.14

Protect Data, Manage Subject Rights, and Consents: Part 1

6.15

Protection Task and Masking Process

6.16

Process of protecting Sensitive Data

6.17

Measure, Communicate Audit Readiness

6.18

Download the Accelerator Content

Data governance is a set of principles and practices that ensure high quality through the complete lifecycle of your data.

Disclaimer:

The GDPR accelerator is an example-based content and may differ from organization to organization. Especially, Regulation and Policy Contents may not be up to date with the latest amendments from the legislature, and policies listed are generic. These may have to be customized by your Legal Team as it's written in response to the Regulation. This book is not intended to convey, does not include, and should not be relied on as legal advice.

How this Book is Organized

This book consists of five chapters, each of which focuses on a topic related to the GDPR and the approach your organization should consider taking to deal with it. Chapter 5 has a proper use case which the Business user should check out. Here’s a glimpse:

Chapter 1: ‘How to Adopt GDPR’: What is GDPR anyway, who does it affect, and how? What does it require, who’s overseeing it, who can help? And, is there perhaps a silver lining?
Chapter 2: ‘Insights into What Data is Affected’: All kinds of different data types exist out there, some that fall under the watchful eye of the GDPR and some that don’t. How can you tell the difference, and what kind of governance will help you deal with the challenge?
Chapter 3: ‘Discovering the Data’: The larger your organization, the more places in-scope data may be stored (or hiding). You need to find all the in-scope data, assess the risks each data store poses, and figure out how to minimize those risks.
Chapter 4: ’Manage Risk and Compliance’: GDPR governs what you can and cannot do with the data you have gathered. But it also underscores the need to keep prying eyes from gaining access to data they should not see. How can you gain the required control?
Chapter 5: ‘Accelerate GDPR Journey’: The GDPR Accelerator has prefilled templates with sample data to showcase how “Sensitive Data” moves across the Onboarding Process. Each template defines the facets and relationships between the facets. It’s mainly concentrated on importing the GDPR body and polices related to the GDPR. Facets that are targeted for this accelerator are Glossary, Regulation, Policy, System, Datasets, Attributes, People, etc.

What is GDPR?

GDPR is a regulation that requires businesses to protect the personal data and privacy of individuals in EU member states. And non-compliance could cost companies dearly.

Companies that collect, store, or use data on individuals in the European Union (EU) countries need to comply with strict new rules around protecting customer data. The General Data Protection Regulation (GDPR) sets a new standard for consumer rights regarding their data.

Whom it affects, and How?

The GDPR defines several roles with responsibility for ensuring compliance, including the Data Controller, the Data Processor and the Data Protection Officer (DPO). The Data Controller defines how personal data is processed and the purposes for which it is processed. The Controller is also responsible for making sure that outside contractors who process personal data on the controller’s behalf do so in compliance with the GDPR.

Data Processors are the outside contractors or other entities that process personal data on behalf of the controller. The GDPR holds processors liable for damages caused by the processors’ non-compliance with the GDPR or with the controller’s instructions. Where a processor such as a cloud provider fails to pay, however, the controller is ultimately responsible for the entire damages, even if the fault is entirely on the processing partner.

The GDPR requires the controller and the processor to designate a DPO to monitor GDPR compliance and advise on obligations under the GDPR. Companies are required to have a DPO if they are a public authority other than a court, perform regular and systematic monitoring of individuals on a large scale, or process on a large scale special categories of personal data or personal data relating to criminal offenses and convictions.

Rights and responsibilities under GDPR:

Individuals have the right to be informed about the collection and use of their data. This is a key transparency requirement under the GDPR.
You must provide individuals with information including your purposes for processing their data, your retention period for that personal data, and who it will be shared with. We call this ‘privacy information’.
You must provide privacy information to individuals at the time you collect their data from them.
If you obtain personal data from other sources, you must provide individuals with privacy information within a reasonable period of obtaining the data and no later than one month.
The information you provide to people must be concise, transparent, intelligible, easily accessible, and it must use clear and plain language.
It is often most effective to provide privacy information to people using a combination of different techniques including layering, dashboards, and just-in-time notices.
You must regularly review, and where necessary, update your privacy information. You must bring any new uses of an individual’s data to their attention before you start the processing.
Getting the right to be informed correctly can help you to comply with other aspects of the GDPR and build trust with people but getting it wrong can leave you open to fines and lead to reputational damage.

Challenges of Compliance:

Many new requirements - To encourage transparency, various obligations regulate information, access, and communication with the data subject. New and improved rights for the data subject, such as the right to data portability and the right to be forgotten, impact companies because such rights need to be accommodated in their internal processes.
Very process-driven - The GDPR sets out specific processes for companies to adopt. It intends to help the company structure and formalize certain subject areas like risk assessment and decision making. By putting these structured processes
Very tangible and visible/verifiable functions and steps need to be realized - It’s not only a question of complying with general principles, such as data minimization or accuracy; the GDPR also imposes very concrete measures. For instance, the GDPR imposes an obligation on companies to keep internal records of their data processing activities. Also, data breaches must be notified to supervisory authorities without undue delay unless unlikely to result in a risk to the rights and freedoms of individuals and it also must be documented, explaining the underlying facts, the likely consequences, and the remedial action that is taken. And there is more: new roles will be created, such as the Data Protection Officer (DPO). Appointing a DPO can be mandatory as explained above, for example for businesses engaging in profiling or tracking online behavior on a large scale or for biomedical companies that process health data on a large scale.
Increased fines and sanctions - The GDPR could have a huge impact on companies failing to comply. The supervisory authorities can take one or more measures listed in the GDPR, such as (i) issue a warning or impose a temporary or definitive ban on processing personal data, or (ii) impose a fine up to EUR 20,000,000 or 4% of the total worldwide turnover, depending on the circumstances of each case, or both.

The GDPR is Europe's current data protection regulation. It replaced the previous 1995 data protection directive. The new regulation started on 25 May 2018. It is enforced by each member state’s supervisory authority(ies) (the Information Commissioner's Office (ICO) in the UK).

One of the biggest, and most talked about, elements of the GDPR is the power for regulators to fine businesses that don't comply with it. These monetary penalties will be decided upon by the supervisory authority. However, the GDPR is not ultimately about fines. It’s about putting the consumer and citizen first.

You could argue that advances in technology are among the root causes of the many issues that the GDPR addresses. The more dependent we become upon data and the technology used to collect, process, and share that data, the more we need to protect data and to ensure that it is not used in ways contrary to the interests of the individual.

The good news is that technology provides solutions, too. In fact, with every challenge comes a new opportunity, and the improvements in understanding, governing, and overseeing data necessary to meet the challenge of GDPR can also result in additional benefits around your organization’s use of data.

Technology providers have stepped up to make it easier to address GDPR requirements. Informatica brings deep expertise in data management and data governance to help organizations on their path to GDPR compliance. Innovative new data management capabilities make it possible for you to wind up in a better spot after GDPR than you were in before. Informatica has developed integrated and intelligent software solutions for governance and compliance that provide an ideal support system for a GDPR initiative.

Figure 2. Shared Metadata-driven Intelligence Accelerates Your Privacy Journey

The Geographic Scope of GDPR

Unlike under the current regime, the GDPR places any business located anywhere in the world under its terms if the business offers goods or services to people in the EU or monitors the behavior of EU individuals, irrespective of whether it has a presence in Europe.

Taking an Enterprise-Wide Approach

Today it is more important than ever for marketing, technology, and legal teams to work together to focus on a cohesive result rather than crossing the departments’ independent “finish lines.” As organizations cast a wider global net in marketing, they need to get their legal teams more involved because there are jurisdictional and legal compliance issues that arise from advertising globally.

No matter where your company is located, if it has an online presence, it will likely be affected by GDPR. Because the regulation aims to ensure that users know, understand, and where applicable consent to private data being collected about them. Companies are now required to be clear and concise about their collection and use of personal data. Companies have to spell out why the data is being collected and whether it will be used to create profiles of people’s actions and habits. Moreover, consumers will gain the right to access data companies’ stores about them and the right to correct inaccurate information.

Technology and Business go hand in hand:

Policy Definition: This includes business and IT definitions, plus documentation across all operational levels of the business, and logical and physical data and process models.
Responsibilities: You must determine who owns the data, who uses the data, and what functions within your organization have responsibility for the data’s quality and security.
Definition of terms and process: This has to do with business processes, key data entities, attributes, systems, quality and controls, standardization, and how the business captures and acknowledges the consent of data subjects to use their data.
Change process: You need a governed process for definitions, a governed process for change, and overall process governance.
Linkage to artifacts: This refers to logical-to-physical artifact linkage, producing the technical and business data lineage needed to understand the dependencies, and ensure the quality, of in-scope data.

Figure 3. Complete Governance Cycle

Your Data Governance Initiative

Data Platform should deliver a single source of truth for data governance and regulatory compliance.

Powerful MetaData: Metadata turns unstructured data into objects that can be separated into the useless, the useful and the mission-critical. It’s a crucial tool for efficient long-term data management.
Automated Enrichment: We shine a light on dark data assets, enriching them with valuable metadata to help simplify compliance and secure your data, no matter where it resides.
Simplified Compliance: Our intelligent data governance solutions are included on a single platform that extends across private and public cloud, reducing the cost and complexity of data governance and compliance reporting.

Different ways in which Data is siloed across an Organization:

Company Culture: Often departments are siloed from each other, especially in larger companies. Sometimes this occurs because there is internal competition, but often it happens because one department sees itself as separate from another and doesn’t consider where information should be shared.
Organizational Structures: Unless an organization specifically works to integrate different departments, it’s easy to build layers of hierarchy and management that deter departments from sharing information.
Technology: It’s not uncommon for different departments to use different technology, making it difficult for the departments to share common information. For example, maybe the Sales team uses Salesforce, but the Marketing team doesn’t have this tool. Yet, it might contain valuable information that the Marketing team could use. An IT survey showed that most companies have between 1-200 applications for their different departments. Consider how unwieldy it can be to find information when you have so many different sources.
Inability to get a comprehensive view of Data: If your data is siloed, relevant connections between siloed data can easily be missed. Suppose, for example, the Marketing team has excellent data on which Marketing campaigns attracted a lot of attention in a geography, whereas the Sales team has information about sales in that same geography. What if you could bring that information together? Imagine how much clearer the relationship between Marketing campaigns and sales would be.
Wasted Resources: Consider what happens if you have a database with customer information for the Marketing team and a separate one for the Sales team. Much data is duplicated between these departments. It costs money to store all this data, and the more data a company stores, the less the organization can spend on other requirements
Inconsistent Data: In Data Silos, it’s common to store the same information in different places. When this happens, there is a high chance that you will introduce data inconsistencies. You might update a customer address in one place and not another. Or, you might introduce a typo in one set of information. When the data is in one place, you have a much better chance of maintaining the correct information.

Typically, sensitive information is scattered across the enterprise. Over the years, the data center can grow to include potentially hundreds or thousands of database servers that store this sensitive information. These servers can be scattered across the globe. Developers and quality assurance testers who create their databases with sensitive information compound this situation and most companies simply do not know where all their data is. This lack of visibility into critical data assets leaves companies exposed to significant risks. The ability to understand where data stores are located, what is in those stores, and who has access to stored data is a critical step in understanding data risk and achieving data governance and compliance.

Risk management requires knowledge about data assets- where they are, what is happening to them, what bad things might happen to them, and, most importantly, the costs associated with the bad things that could happen to them.

Organizations must control three key areas of data risk:

Discover sensitive data: Discovery begins with finding and identifying critical data assets in the network, determining what data stores exist, and finding information inside of those data stores.
Assess data activity risk: To understand data risk an organization must know who has access to which data. Visibility into data usage and the associated risks is essential for developing the appropriate compliance and security strategy. This includes identifying how data is being used and which users and applications are accessing data from where and when. This assessment must encompass all applications, users, and processes relating to the access to sensitive data.
Ensure data compliance: To comply with a variety of privacy and financial regulations, dozens of data protection requirements must be addressed. Compliance with these regulations includes the ability to provide regular and detailed reports that address the requirements of outside assessors and internal stakeholders.

Capabilities of Intelligent Data Catalog:

Data Policy Definition: This capability gets into both business and IT definitions, as well as vague data and policy conflict.
Automated Data Discovery: This capability is about finding relevant in-scope sensitive or personal data on the first pass, followed by continual monitoring, plus classification of data and integration of supporting systems. Data must be definedin context, with intelligent policies that identify whether a combination of specific data elements (such as name, email,and national ID) can be combined in any data store to identify privacy data of GDPR subjects.
Data Proliferation Analysis: Data tends to move around, which is what proliferation refers to. It isn’t only a matter of finding out where the data is. You need to know where it goes and what new sources of data are emerging.
Data Risk Scoring: This considers the factors listed earlier, including movement of data, proliferation, access, volume, value, and prioritization. This capability should include planning, history, and score monitoring over time.Monitoring would include excess access, anomalous user behavior, and cross-border data transfers.

Introduction:

Complying with GDPR may require a lot of processes and procedures as you ensure that you can answer data subjects’ requests and implement their rights. There’s also a fair amount of technology because all the sensitive data involved must be secure.

Security is certainly a technological matter, in terms of building defenses against hacking. But in the end, much of it is a matter of creating controls to ensure that only the right people can access sensitive or personal data.

This chapter focuses on the need for properly restricting access to the data you’re holding on protected individuals. It describes helpful data protection controls and outlines technology solutions.

Why Data Protection Controls

Of the requirements of the GDPR, one of the most basic tenets is protecting your data from being accessed by unauthorized users. That calls for some serious data security controls.

To begin with, from an IT perspective, you face various requirements that privacy data be encrypted, access-controlled, removed, masked, or pseudonymized. It covers data being used in a wide variety of ways, from internal processes, customer services, and order processing to analytics and reporting. Your concerns about data protection also cover data related to testing and development, activities that bring their own sets of issues and challenges.

In practice, ensuring effective data security means reviewing for compliance purposes all the applications that contain or access personal data. These applications need tight data access control for personal data at a user level.

Consider production data - Various people might have access to the data, from administration to product support to app users to partners. Some are authorized, but some are not, and the app infrastructure must remain as is. Because you have unauthorized users in the mix, you would want to mask sensitive or personal data to prevent unauthorized access, through what’s known as hand, involves interactions with data analysts, data scientists, and testers and developers, and potentially no one is an authorized user. Your goal is to remove any risk of sensitive or personal data access, so an effective approach is to fictionalize data for testing or research purposes and permanently change sensitive or personal data. Persistent data masking is the name of the game.

How you’ll protect your organization’s data and ensure that you have the appropriate controls? How do you gain the kind of access control you need to protect the in-scope information of data subjects? By enabling strong and sophisticated security controls. Your chief legal officer, CIO, and chief data officer should be part of the solution concerning this dilemma. As for the required capabilities, you need enterprise-wide protection and controls over data. These data controls must cover access controls, data deletion and retention, data masking, archiving, and pseudonymization.

The below technology helps with protection:

Risk analysis input: You’ve done the risk scoring; now use it to direct data control methods.
Orchestration: This musical term refers to the ability to schedule and coordinate data protection tasks by identifying risks and ongoing monitoring of unsafe access or conditions.
Data security controls: These include static or dynamic masking, pseudonymization, role-based access controls, encryption, and tokenization.
Change/update history: You’re comparing the application against source systems, the record masking or archiving outcomes against a consent record, and generating an audit trail for evidence.
Archiving: This activity takes data out of production systems and archives it, logs the activity to provide evidence, andmoves sensitive or personal data offline to prevent accidental usage or access.

Informatica weighs in with powerful solutions that help with privacy and the security of data assets. You can use Persistent Data Masking and Dynamic Data Masking to help automatically limit the number of people and systems that have unrestricted access to personal data. Informatica’s Data Privacy Managementmeanwhile, provides extensions to Persistent Data Masking for protection. Data Archive helps organizations remove data that is no longer needed for business operations but could pose privacy risk if exposed. It also helps support the data minimization principles outlined in the GDPR.

It’s tremendously helpful to build this kind of automation into data masking. You reduce the risk of personal data breaches and make it a whole lot less likely that unprotected personal data finds its way out to an accessible environment.

The GDPR Accelerator has the prefilled templates with a sample of data mainly to showcase how the “Sensitive Data” moves across the Onboarding Process. Each template defines the facets and relationships between the facets. Mainly concentrated on importing the GDPR body and polices related to the GDPR. Facets that are targeted for this accelerator are Glossary, Regulation, Policy, System, Datasets, Attributes, People, Role, Process, Legal Entity OrgUnit, and Data quality as well.

Templates for different facets like glossary, regulation, Policy, people, system, Datasets are straight forward. These templates import the respective sample data to each facet. The other set of templates builds a relationship between the facets and adds the stakeholders responsible for the asset. About the process: The template has another subprocess which helps to build a proper Onboarding process example like Client registration, KYC check, and so on. Process templates have the capability of attaching another subprocess as well.

After the complete import of the templates, the Onboarding process example takes you to the demopart of how sensitive data moves across the entire process. Overlays in the process facets show:

Related Glossaries
Affecting Systems
Responsible Stakeholders
Legal Entity processer and contributors
Related Policies
Data Quality results

Along with this sample process example, there will be an exercise with another tool called “Data Privacy Management” that helps an organization to check whether the sensitive data is Protected, the Risk score, Risk Cost, and Security Levels of the Datastore. The tool has the capability of masking sensitive data with the privacy rules applied. With the help of a privacy dashboard showing to the Business users in Axon, it makes users immediately take actions based on the result. The Risk Score, Protection status, and Sensitive Levels are visible at the process overlays for System.

The DSAR reports can be generated with the help of DPM and a sample report is given in this accelerator. To Generate the DSAR one must create the Subject registry for the resource and the sample files required to generate the Subject Registry are included in the Accelerator.

There could be a scenario where Business users want to understand the sensitive data which are related to any groups say GDPR/PII/PCI domains and can see the holistic view

on a single page. A view is showed in this Accelerator to show how the table is linked to data domains, a business term, rules, profile results, a user associated, and so on.

The other requirement would be change management, this would be the main use case requirement in most organizations that see the audit reports on what all have changed, who have made changes, who have requested, and so forth.

Herewith this Accelerator we do have a workflow that the user can customize and can build workflow as per the required basis.

Workflow is utilized and showed during the journey which talks about the roles responsible for each task and audit is maintained for the same to monitor.

The Accelerator covers the main use cases like:

SRR (Subject Rights Requests)
DSAR (Data Subject Access Request)
RTBF (Right to Be Forgotten)
Right to Rectification

Configuration Video

&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;nbsp;

Loading Assets - Object Dependencies

DonBank Inc. is one of the largest banking and financial services organizations in the world. DonBank’s International Network comprises of around 6,000 offices in over 75 countries and territories in Europe, the Asia-Pacific region, the Americas, the Middle East and Africa.

DonBank Inc. is one of the three major clearing banks in Europe and is a wholly owned subsidiary of DonBank Holdings. The business ranges from the traditional high street roles of personal finance and commercial banking, to private banking, consumer finance as well as corporate and investment banking. Across all brands the bank operates in some 1800 sites in the Europe.

The DonBank has its head office in Utrecht, Netherlands. DonBank is a data driven organization. It is focused on implementing GDPR.

The role of the Data Protection Officer in DonBank is an enterprise security leadership role and is required by the General Data Protection Regulation (GDPR). As a DPO he is responsible for overseeing the company’s data protection strategy and its implementation to ensure compliance with GDPR requirements.

Data Governance Officer provided the Data Governance framework – Axon, Data Privacy Management, and Test Data Management to be leveraged. He has collaborated with the Legal team to address the GDPR regulatory policies and has started defining the corresponding processes, systems, glossaries, datasets, and attributes in Axon required to meet the compliance requirements.

Figure 5. Data Governance Framework for Privacy Regulations

By seeing the details in the workflow Mike opens the Client Onboarding process (COB) by using the Unison search and clicks on the ‘Components’. This shows the complete flow of the COB process and all the sub-processes. The subprocess is linked with the help of the import template.

The process starts from ‘Client Registration’ followed by a KYC check and after condition, if KYC is good, it moves to Activate the Customer and the client receives registration process and after condition, match Client receives offers in the ‘Yes send client Offers/Products Pack’, If not then there’s No record client preference. This is the overview of the Onboarding process.

Figure 15. COB Process Diagram

To see the personal data moving through the process, Mike opens the Glossary overlay. The below Glossary overlay highlighted with the Full Name and personal data shows the movement through the process. He adds the security classification in the same overlay, and that shows that the data is confidential, protected, or restricted. He sees that there are personal data that are restricted and it’s a special category data and it must be treated even more carefully, and by now he understands what kind of personal data he is dealing with and how it is moving through the process.

Figure 16. Glossary Overlay in COB Process

How to Map Identities?

Link identities to sensitive data
Intelligence on location, systems
Intelligence on use, access

SUBJECT REGISTRY in Data Privacy Management provides identity mapping capabilities that support data privacy legislation such as GDPR Specifically. Subject Registry maps individuals with the data that you maintain on them and provides a detailed report on the location and type of data.

Mike can now quickly locate an individual's sensitive data, search for the individual by name, or any other identifying detail. The search panelists one or more individuals that match the search criteria. It helps determine the correct individual and then access the detailed view to determine the data stores, schemas, tables, fields, and files that contain the individual's sensitive data.

Blake is a premium customer. He wants to know where all his data is residing in Customer DATA ASSETS.
He has submitted a request and the Data Protection Office has forwarded his request to the Data Privacy Management Administrator.
The Data Privacy Management Administrator will have to generate a report and respond to DPO’s ticket.

Figure 21. Subject Registry

The DSAR report is created and is shown below. The report can be downloaded and can be sent to the customer to get consent on the same. The report is attached to the DPM files provided in the link. (Link needs to be attached to get the sample of the report)

The Data Subject Access Rights report for Blake lists all the Data Sources and sensitive fields associated with him and is listed in this report.

Thus, Mike is now able to generate the report to get consent on the sensitive data.

Figure 22. DSAR Report

You can create and manage plans to reduce the risk score and residual risk cost of unprotected sensitive data domains in one or more data stores. For each risk simulation plan, you can adjust the protection status of sensitive data domains in scanned data stores to simulate the impact on the potential cost to your organization in the event of a security breach.

Figure 28. Risk Simulation Plan

Configure the RISK Simulation plan properties

Configure risk simulation plan protection properties for each datastore included in the plan to reduce the risk score and residual risk cost of unprotected sensitive data.

On the Risk Simulation Plan Details page, you can select sensitive data domains to protect for each scanned data store included in the plan.

The following image shows the risk simulation plan protection properties on the Risk Simulation Plan Details.

Figure 29. Risk Simulation Plan Protection Properties

Property

Description

Data Domain

Required. Select one or more sensitive data domains for the selected data store to simulate the impact that protecting data will have on the risk score, protection status, and residual risk cost indicators.

Protection

Required. Select a protection method to simulate the risk impact.

Based on the assessment of the sensitive data now he plans to mask the data. Now DPO(Otto) asks to protect the sensitive data with the help of DPM and persistence data masking.

How to manage subject rights?

Implement data protection and monitor for misuse
Respond to subject rights (i.e. DSAR) and consent requests.
Communicate remediation, alerts, consent status

A simple diagram shows that once the DSAR report is generated, the consent is taken to protect the data. Even to mask the data or to delete the data or to archive the data the consent is very important as per the GDPR guidelines and policies.

Enacting Consent / Right to be Forgotten

Figure 30. Consent Diagram

Consent from customers can be taken from third-party tools and Informatica MDM C360. Now Mike knows that with the help of the subject registry, what all the sensitive data and which all tables contain the sensitive data now as per the consent taken, that need to protect data.

The below screenshot shows the protection status is in ‘Red’ which means there is no protection applied on any sensitive columns. DPO (Otto) logs in to the DPM and sees what all sensitive data is protected.

Figure 31. Protection Status

Figure 32. Protection Task Status

The process which has sensitive data is also captured to see the protection status.

Figure 33. Sensitive Data in Process