GDPR COMPLIANCE

Personal data can only be correctly managed if it is first correctly identified. Automated classification allows you to categorize new and existing information so that it can be managed and accessed appropriately. Multiple classification criteria can be applied, such as data owner, sensitivity level and required retention period. Integration with analytics engines allows personal information to be identified quickly from new data sources.

The GDPR gives individuals the right to request access to their personal data and the right to have that information transferred to another service provider in open, shareable formats. Organizations must provide the requested data within one month. The Columbus suite lets you capture and store data in diverse formats and transform it automatically into a range of common formats such as CSV or XML, to satisfy customer access and transfer requests promptly.

The GDPR data minimization principle requires you to limit the personal information you hold to the absolute minimum, and to retain it no longer than strictly necessary. Rules-based information lifecycle management allows you to set data retention policies to manage information from cradle to grave and erase data automatically when there is no longer a legitimate purpose for retaining it. Equally, you can delete personal data immediately on request whenever customers exercise their right to erasure, and provide a tamper-evident audit trail to prove that requests have been fulfilled, with blockchain integration to provide a trusted record of events.

The GDPR requires organizations to put in place technology and processes founded on data protection principles. Comprehensive data security and privacy measures are built into the Columbus suite to ensure that personal data stays protected at all times. Features include advanced identity and access management; certified authentication measures such as digital signatures; data segregation; data redaction; data disguising to support anonymization and pseudonymization; and secure, tamper-evident and encrypted data storage.

Proactive, real-time monitoring allows you to keep track of all activities related to personal data – such as access, erasure and distribution to third parties – and generate detailed information which can be shared with regulators and auditors to provide proof of compliance. You can also use automated alerts to flag up potential compliance issues and pass information to security information and event management (SIEM) systems to prompt investigation of unusual or suspicious events.