Editorial & Advertiser Disclosure Global Banking And Finance Review is an independent publisher which offers News, information, Analysis, Opinion, Press Releases, Reviews, Research reports covering various economies, industries, products, services and companies. The content available on globalbankingandfinance.com is sourced by a mixture of different methods which is not limited to content produced and supplied by various staff writers, journalists, freelancers, individuals, organizations, companies, PR agencies Sponsored Posts etc. The information available on this website is purely for educational and informational purposes only. We cannot guarantee the accuracy or applicability of any of the information provided at globalbankingandfinance.com with respect to your individual or personal circumstances. Please seek professional advice from a qualified professional before making any financial decisions. Globalbankingandfinance.com also links to various third party websites and we cannot guarantee the accuracy or applicability of the information provided by third party websites. Links from various articles on our site to third party websites are a mixture of non-sponsored links and sponsored links. Only a very small fraction of the links which point to external websites are affiliate links. Some of the links which you may click on our website may link to various products and services from our partners who may compensate us if you buy a service or product or fill a form or install an app. This will not incur additional cost to you. A very few articles on our website are sponsored posts or paid advertorials. These are marked as sponsored posts at the bottom of each post. For avoidance of any doubts and to make it easier for you to differentiate sponsored or non-sponsored articles or links, you may consider all articles on our site or all links to external websites as sponsored . Please note that some of the services or products which we talk about carry a high level of risk and may not be suitable for everyone. These may be complex services or products and we request the readers to consider this purely from an educational standpoint. The information provided on this website is general in nature. Global Banking & Finance Review expressly disclaims any liability without any limitation which may arise directly or indirectly from the use of such information.

Keep calm, it’s only GDPR! Seven questions to ask your technology provider

According to Thomas Rodseth, VP of Product & Marketing at Puzzel, organisations that take data security seriously are halfway to being GDPR ready. They just need to take a closer look at their technology provider and ask the right questions.

The fast approaching deadline for the General Data Protection Regulation (GDPR) on 25th May 2018 continues to cause concern for many organisations. Although the legislation plans to override national data protection laws and impose additional requirements for companies that collect or store personal data of European Union residents, GDPR should be welcomed as a positive step. It will encourage companies to review their data policies and practices as part of ongoing business continuity planning to ensure that they comply with GDPR.

Data security as second nature

The good news is that many of our customers are unknowingly well prepared for GDPR from day one. They are contact centres that everyday focus on the security of customer data to ensure it is stored, transmitted and processed securely.

There is little to fear on the basis that your contact centre has a robust set of automated processes backed up with cloud-based solutions, along with trustworthy staff that don’t write down customer details or click on rogue emails. The successful road to GDPR preparedness is taking the time to assess the reliability of those who provide the technology framework on which your contact centre depends.

Asking the right questions

Now is the right time to have a face-to-face meeting with your technology provider and delve a little deeper into their own ways of working. Here are the top 7 questions to ask and why:

1. How do you store data? – the infrastructure in which data is stored should be built on secure best of breed components. In addition, if your technology provider uses a data centre from another supplier, they should work only with well-recognized co-location partners and both fully manage and operate all the services produced and delivered from that data centre. There should be evidence of regular back-up activity as well as testing and planning for various restore scenarios.

2. Where does the processing of data take place? – transparency is key and data processing needs to take place in Europe (EU/EEA) and follow European regulations and requirements regarding protection of data privacy.

3. What levels of security are available? – this is where the cloud comes into its own. Make sure your technology supplier offers data services over the cloud supported by well-defined and consistent processes. For example, data centres should be locked and alarmed with 24/7 surveillance and accessible only by controlled personnel. All measures should be taken to control the physical environment such as redundant climate control with environmental monitoring of gas, moisture, heat and water; fire alarms with automatic firefighting equipment and an uninterruptible power supply that is regularly tested against power outages.

4. Is there an Information Security Policy? – don’t just take their word for it, ask to see your provider’s Information Security Policy, often in the shape of a formal written handbook that includes a range of underlying procedures detailing security related activities and controls. The policy is the starting point for the top-down risk assessments and should be revised and improved yearly.

5. Can I trust your staff? – one of the important characteristics of efficient security processes is that they are executed by capable and competent employees. Check out your provider’s enrolment process for new employees as well as external parties such as consultants, sub-suppliers and others with access to your data. This should include mandatory signing of confidentiality agreements or non-disclosure agreements and adhering to corporate business and ethics guidelines. All security staff must be properly vetted and regularly trained.

6. What happens if things go wrong? – all organisations you work with should plan for the unplanned with a strong Business Continuity programme based on ISO/IEC 27031 and a dedicated Security Response Team.

7. What certificates do you have to back up your security claims? – ask for proof that they follow industry best practices and undergo regular audits by approved external organisations to minimise risk. In particular, look out for ISO 9001, ISO 27001 and ISO/IEC 27001 accreditation. These certificates demonstrate your provider’s commitment to the protection of information and the assurance that assets are suitably protected – whether held on paper, electronically or as employee knowledge.

Ask the right questions of your technology provider and be sure to get the right answers in return. Choosing the correct partner is critical to GDPR preparedness. The right one will ensure their solutions offer complete transparency and security and have the knowledge and expertise to guide you every step of the way. Make sure they share the same exacting standards as your own organisation. If they do, you can be confident that come 25th May, you will be far ahead of the competition when it comes to compliance with new GDPR legislation.

NB: Puzzel does not offer legal advice or GDPR consultancy.

Thomas Rodseth, VP of Product & Marketing at Puzzel