GDPR Compliance: Getting Everyone On Board · 1. (b) to monitor compliance with this Regulation, with other Union or Member State data protection provisions and with the policies

© IT Governance Ltd 2018

Presenter: Stefanie Retfalvi, Learning Design & Solutions Consultant, IT Governance

GDPR Compliance: Getting Everyone On Board


Agenda

01

02

03

04

06

07

?Q&A

05

Cyber Security Awareness Programme

GDPR Compliance: Getting Everyone

on board

About IT Governance & Introduction


About IT Governance


Introduction

• Stefanie Ildiko RETFALVI

• Learning Design & Solutions Consultant

• International cross-sector experience


Staff Awareness & The GDPR


Article 36

1. (b) to monitor compliance with this Regulation, with other Union or Member State data protection provisions and with the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits;

“


Why it matters

ICO publication:Preparing for the General Data Protection Regulation (GDPR): 12 steps to take now


Stakeholders, Focus Groups & Planning


Compliance affects Everyone

• C-Suite, senior management buy-in (leading by example)

• DPOs, CISOs, CIOs • Business process owners• HR, change management, internal comms• Focus groups • Surveys


Managing Change


Dealing with resistance

Aversion to change is natural

Resistance to Content versus

Resistance to Process Consider this question within your

organisational context


• Understand your audience(s)• Align your strategy and your culture• Read and rewrite the context• Make use of proven engagement techniques• Be opportunistic

Managing the Transition


To attain the highest levels of employee engagement, it is important to generate personal investment and motivation for adopting the GDPR.

“Bringing about a Change in Mindset


Common Challenges


The GDPR as a focal subject• Viewed as dry • Perceived as overwhelming• Misconceptions (regarding

implications)


Training Audit Trail True Engagement & Behaviour Change


Proven Techniques & Solutions


Identifying Problems

Identifying common drivers for resistance or gaps in understanding is the first step to gaining organisation-wide buy-in.

“


Implementing a GDPR Awareness Programme

It is important to offer a modern mix of different GDPR-focused learning and communications tools to address individuals’ diverse needs and preferences.

“


Gaining Buy-In

Don’t treat GDPR awareness training like a bitter medicine that everyone needs to swallow.

“


Example


Delivering Knowledge

Understanding the GDPR will help to mitigate aversion to change and reduce the human factor as a risk.

“


Example


Encouraging Knowledge Transfer to the Workplace

It is not enough to know what best practice involves. Employees need to apply their obtained knowledge in their everyday activities.

“


Sample Solution

These should:• Be meaningful, encouraging deep reflection and the transfer

of acquired knowledge to the workplace;• Make learners active participants by challenging them to

recall key information in relevant contexts; and • Prompt participants to identify risks and apply best practice

in situations that could arise in real life on the job.


Example


Continual monitoring of progress will ensure that everyone has achieved the required level of knowledge and understanding.

“Evaluation


Example


Once the programme is finished, it is important to ensure that the GDPR remains at the forefront of individuals’ minds.

“Continual Reinforcement


Useful References


Useful References

“GDPR in the workplace”“Employee communication”“Change management”https://www.cipd.co.uk/http://www.wfpma.com/https://ico.org.uk/about-the-ico/what-we-do/taking-action-data-protection/https://www.itgovernance.co.uk/blog

https://www.cipd.co.uk/

http://www.wfpma.com/

https://ico.org.uk/about-the-ico/what-we-do/taking-action-data-protection/

https://www.itgovernance.co.uk/blog


Conclusion & Your turn! Q&A


Conclusion


Call us+44 (0)333 800 7000

Email [email protected]

Visit our websitewww.itgovernance.co.uk

Like us on Facebook/ITGovernanceLtd

Follow us on Twitter/itgovernance

Join us on LinkedIn/company/it-governance

Read our blogwww.itgovernance.co.uk/blog

Stay in touch!


Queries?

Understanding?

Clarification?

Your Turn!

Documents

GDPR Compliance: Getting Everyone On Board · 1. (b) to monitor compliance with this Regulation, with other Union or Member State data protection provisions and with the policies