GDPR Case Study
Requirement
Assist a growing U.S. based sportswear clothing company with General Data Protection Regulation (GDPR) compliance as the organization was seeing tremendous growth in the European Union (EU) market.
Issues
The client was experiencing double-digit growth year-after-year, with a significant number of sales being generated in the European Union (EU). The client had no formalized GDPR compliance measures in place, and was unsure of where to even begin. Senior management wanted a game plan put in place, and immediately.
Additional issues for the client
No Experience with Compliance at this Level: While the client had familiarity with basic data privacy rights for protecting consumer information, they had no real understanding of the complexities of GDPR in terms of website compliance, data subjects rights, and much more.
No Privacy Documentation: With no experience - and no real understanding - of data privacy, naturally, the client had no privacy policies and procedures in place. Additionally, they were also void of any real or meaningful information security, cybersecurity, and data privacy policies and procedures.
Unclear Roadmap: The client was also unsure of where to even begin in terms of such a daunting compliance project. There were different opinions and recommendations, all of which had a number of challenges.
Solution
Centris deployed a team of experts specializing in the GDPR that successfully accomplished the following:
- Performed a comprehensive gap analysis for determining areas requiring remediation and other necessary measures relating to the specific GDPR requirements.
- Defined project scope and client participation, assigning roles, responsibilities - and hard deadlines and deliverables - to all personnel involved on the project.
- Assessed gaps and put in place a plan-of-action for developing all required data privacy and information security policies and procedures and other supporting documents.
Outcome
- Built and deployed an all-new set of data privacy and information security policies, procedures, and processes.
- Created a true culture of compliance where employees now understand and value data privacy and the importance of protecting consumer information.
- Implemented a continuous monitoring program for ensuring data privacy controls are properly monitored long after the consultants are gone.