According to Thomas Rodseth, VP of Product & Marketing at Puzzel, organisations that take data security seriously are halfway to being GDPR ready. They just need to take a closer look at their technology provider and ask the right questions.

The fast approaching deadline for the General Data Protection Regulation (GDPR) on 25th May 2018 continues to cause concern for many organisations. Although the legislation plans to override national data protection laws and impose additional requirements for companies that collect or store personal data of European Union residents, GDPR should be welcomed as a positive step. It will encourage companies to review their data policies and practices as part of ongoing business continuity planning to ensure that they comply with GDPR.

Data security as second nature

The good news is that many of our customers are unknowingly well prepared for GDPR from day one. They are contact centres that everyday focus on the security of customer data to ensure it is stored, transmitted and processed securely.

There is little to fear on the basis that your contact centre has a robust set of automated processes backed up with cloud-based solutions, along with trustworthy staff that don’t write down customer details or click on rogue emails. The successful road to GDPR preparedness is taking the time to assess the reliability of those who provide the technology framework on which your contact centre depends.

Asking the right questions

Now is the right time to have a face-to-face meeting with your technology provider and delve a little deeper into their own ways of working. Here are the top 7 questions to ask and why:

1. How do you store data? – the infrastructure in which data is stored should be built on secure best of breed components. In addition, if your technology provider uses a data centre from another supplier, they should work only with well-recognized co-location partners and both fully manage and operate all the services produced and delivered from that data centre. There should be evidence of regular back-up activity as well as testing and planning for various restore scenarios.

2. Where does the processing of data take place? – transparency is key and data processing needs to take place in Europe (EU/EEA) and follow European regulations and requirements regarding protection of data privacy.

3. What levels of security are available? – this is where the cloud comes into its own. Make sure your technology supplier offers data services over the cloud supported by well-defined and consistent processes. For example, data centres should be locked and alarmed with 24/7 surveillance and accessible only by controlled personnel. All measures should be taken to control the physical environment such as redundant climate control with environmental monitoring of gas, moisture, heat and water; fire alarms with automatic firefighting equipment and an uninterruptible power supply that is regularly tested against power outages.

4. Is there an Information Security Policy? – don’t just take their word for it, ask to see your provider’s Information Security Policy, often in the shape of a formal written handbook that includes a range of underlying procedures detailing security related activities and controls. The policy is the starting point for the top-down risk assessments and should be revised and improved yearly.

5. Can I trust your staff? – one of the important characteristics of efficient security processes is that they are executed by capable and competent employees. Check out your provider’s enrolment process for new employees as well as external parties such as consultants, sub-suppliers and others with access to your data. This should include mandatory signing of confidentiality agreements or non-disclosure agreements and adhering to corporate business and ethics guidelines. All security staff must be properly vetted and regularly trained.

6. What happens if things go wrong? – all organisations you work with should plan for the unplanned with a strong Business Continuity programme based on ISO/IEC 27031 and a dedicated Security Response Team.

7. What certificates do you have to back up your security claims? – ask for proof that they follow industry best practices and undergo regular audits by approved external organisations to minimise risk. In particular, look out for ISO 9001, ISO 27001 and ISO/IEC 27001 accreditation. These certificates demonstrate your provider’s commitment to the protection of information and the assurance that assets are suitably protected – whether held on paper, electronically or as employee knowledge.

Ask the right questions of your technology provider and be sure to get the right answers in return. Choosing the correct partner is critical to GDPR preparedness. The right one will ensure their solutions offer complete transparency and security and have the knowledge and expertise to guide you every step of the way. Make sure they share the same exacting standards as your own organisation. If they do, you can be confident that come 25th May, you will be far ahead of the competition when it comes to compliance with new GDPR legislation.

NB: Puzzel does not offer legal advice or GDPR consultancy.

Thomas Rodseth, VP of Product & Marketing at Puzzel