For a long time the General Data Protection Regulation has been looming on the horizon but in just a few short days it will arrive; a permanent aspect of the data protection landscape. From 25th May 2018 this European-wide data protection will be a legal requirement for virtually every UK organisation. The task should not be overwhelming; particularly for those who are already PCI compliant, or working towards it. This is because the PCI compliance process means they are already well on course for GDPR. All that remains is an identification of gaps to bring systems and policies in line with GDPR.
The important thing to bear in mind at this stage is that the GDPR, although aimed at the entirety of an organisation and largely enforceable, is less prescriptive than the PCI DSS standard that already exists. GDPR provides detail about what needs protecting but very little in the way of a solid action plan.
PCI DSS on the other hand offers a detailed framework upon which to build, specifying what needs to be done and how, and even giving regular updates and guidance on reviews. The two complement each other and therefore the GDPR will be best enacted alongside the existing PCI DSS. A further aspect to note, is that a PCI breach will also be a GDPR breach, since the information on your cardholder data environment is subject to regulation by GDPR.
GDPR should not be seen in a negative way. It is a positive piece of legislation which will help to build trust. Similarly, PCI DSS compliance provides you and your customers with peace of mind that data is secure. This is the metaphorical carrot. There is also a stick: those who do not comply and suffer a breach will face loss of customer trust, enforced PFI investigations and fines.
For those that are already compliant with the PCI DSS, an annual review of the data being processed should form an integral part of the project. This ensures that any new technologies or processes are not excluded and ongoing compliance is maintained. Once you have identified the data that GDPR affects, applying the PCI approach to the implementation of the GDPR will assist greatly as the framework is already there. There will still be a few gaps to fully adhere to GDPR so professional advice will be of benefit.
And for those who aren’t PCI compliant? Seeking guidance from a qualified advisor and reviewing the gaps in their documentation, policies, training, IT systems and processes should be a pressing matter.
With one of the largest QSA teams in Europe, SRM provide unrivalled technical and compliance expertise within the PCI arena. Our GDPR team provide a business-focused service to organisations at all ends of the GDPR-readiness spectrum. For help and support, or to discuss any aspect of PCI DSS compliance or GDPR contact Mark Nordstrom at firstname.lastname@example.org or 03450 21 21 51.
To gauge your level of GDPR readiness, complete our free GDPR Self Assessment Questionnaire
For more information on our GDPR services, visit our GDPR page.
To view a recording of our webinar GDPR: the roles of manual and automated penetration testing, click here.
Read more on GDPR related blogs.