Centris’ GDPR gap assessment services provide controllers and processors with a crystal-clear look into their operations and the supporting internal controls needed for ensuring GDPR compliance is met. Centris’ GDPR gap assessments consists of the following measures:

(1) Defining Scoping Considerations:

The GDPR is a massive piece of legislation with many moving parts (https://gdpr-info.eu/, 11 Chapters and 99 articles), so it’s important that controllers and processors know what they’re up against in terms of compliance, which ultimately begins with assessing scope. Questions that we get answers to during this process include the following:

• What types of personal data for data subjects are being stored, processed, and transmitted?
• What third-parties are also considered in scope for the GDPR, why, and do they have proper controls in place?
• What internal and external personnel will be involved in working with Centris during and after the GDPR gap assessment activities?

(2) Assessing Data Privacy Requirements & Gaps:

The operational aspects of GDPR compliance are far-reaching indeed as controllers and processors need to ensure that various H.R., legal, privacy, and other prescriptive requirements are met for compliance. For example, do you have privacy policies, procedures, and processes in place for correcting and erasing personal data. Additionally, do you have well-documented incident response initiatives for responding to incidents and possible breaches? These are just a few examples of the depth of Centris’ activities during a GDPR gap assessment.

(3) Assessing Information Security Requirements & Gaps:

Per Article 32, “…the controller and the processor shall implement appropriate technical and organizational measures…”. Centris will do a deep dive into your information security policies, procedures, and processes, determining what framework – if any – you have in place, and what areas within the broader application of InfoSec will require remediation for the GDPR.