Can a company actually become GDPR compliant? Is there such a thing?
<p>(This question could be expanded to other auditing procedures too)</p>
<p>How do huge multinational companies that want to become GDPR compliant start off this? I mean, I guess one has to read the regulation, correct? But what if you misunderstood a point? Do companies usually call in an external party like an auditing company or consulting firm specialized in GDPR?</p>
<p>Say you read and understood all the necessary things to be GDPR compliant. You do the privacy impact assessment then implement features within your solution/product to achieve this (Eg: purge user data on demand, opt-in full cookies by default, don't have any &quot;sign me up&quot; box checked by default, etc).</p>
<p>Who then decides whether this set of features that should have been implemented is &quot;complete&quot; or not?</p>
<p>Do auditing firms or whoever says &quot;You are compliant&quot; offer some sort of insurance in case there's a lawsuit and the company has to pay for failing GDPR?</p>
<p>Or they just tell the company &quot;The probability of paying in case of a GDPR lawsuit has been minimized&quot;?</p>

<p>The GDPR consists largely of <em>principles</em> instead of concrete rules. It's possible to reasonably believe that you are fully compliant, but then have a court rule against you. Thus, a company might mitigate risks by getting experienced compliance consultants, and by not toeing the line of what is and isn't allowed. But at some point, working to reduce the remaining risk is not worth the effort. This will depend very much on the business. E.g. an adtech business will likely want to tolerate more risk than a bank.</p>
<p>As the interpretation of the GDPR evolves, compliance efforts must adapt. For example, the Schrems II judgement that invalidated the EU–US Privacy Shield shifted our understanding on the legality of international transfers. This judgement was not necessarily surprising for anyone who paid attention, so to some degree it was possible to prepare in advance. But that judgement was the kind of shift in jurisprudence where you can't fix your compliance by filling out one extra form, but rather have to rethink all international transfers of personal data – a blow to US SaaS providers and European SMEs that depend on them.</p>
<p>Some parts of the GDPR are geared to assist with a compliance process. For example, larger data controllers must create a Records of Processing Activities (ROPA) register. This lists all processing activities and their legal basis, which helps spotting potential compliance gaps. Risky processing activities require an Impact Assessment (DPIA) where the controller has to weigh different factors against each other and determine appropriate safeguards. While the GDPR doesn't necessarily say whether something is allowed or not, it frequently provides factors that must be considered in an analysis.</p>
<p>In addition to the GDPR itself, there's a lot of guidance available. Data protection authorities publish guidelines and can also be consulted directly. In fact, that's sometimes explicitly required. In the EDPB, the different authorities coordinate with each other and publish a series of EU-wide guidelines. Sometimes the subject is very specialized, sometimes the guidelines touch on a very general matter such as the concept of “consent”. These guidelines are an effectively–binding interpretation and thus bring welcome clarity to a compliance process.</p>

<p>To add to the above, there are two entire complimentary fields known as Information Security and Data Protection that support this goal almost more than any other since the advent of GDPR.</p>
<p>Data Protection is usually seen as more strategic while Information Security deals with the underlying principles. Although they don't overlap entirely there is a fair amount that does.</p>
<p>There are near countless ways to become GDPR compliant and a number of different frameworks that support that compliance.</p>
<ul>
<li>ISO27001</li>
<li>ISO27701</li>
<li>NIST CSF</li>
<li>NCSC CAF</li>
<li>NIST SP 800 series</li>
<li>Cyber Essentials</li>
<li>Cyber Essentials+</li>
</ul>
<p>All of these follow a structured approach to implementation, a larger company doesn't necessarily mean more difficult to implement although that is usually the case.</p>
<p>Like anything if there is an existing framework in place everyone is used to it'll take some time to re-do things, the more money is invested the quicker you can become compliant.</p>
<p>That said, I'm an Information Security Consultant and I've never seen a firm that's actually GDPR complaint. I've seen lots that can <em>get through an audit</em> and cover even most of the bases but, 100% compliance? No, doesn't remotely exist otherwise you wouldn't ever hear of people leaving laptops on trains or paperwork on a desk while a reporter walks past. So long as there are humans involved, people will make mistakes compliance will take a knock or two.</p>
<p>The important principle is firms are <em>mostly</em> compliant and have processes in place to address remediation of issues on an on-going basis.</p>

gdpr