Shortly after the GDPR’s passage in 2018, the Commission Nationale Informatique & Libertés (CNIL), France’s data protection authority, published a list of guidelines to help businesses prepare. Their list was a valuable resource for businesses adjusting to the new law.

Today, the GDPR is well-established and has exercised visible influence on other privacy laws worldwide. But the CNIL’s guidelines still hold up. Any time a new privacy law passes that affects your business, or your business expands into a new region with a privacy law you’ve never had to deal with before, change is necessary. The CNIL’s recommended first steps could make a huge difference.

So, when your business has to deal with a new privacy law, what do you do?

1. Appoint a Data Protection Officer (DPO)

The first real step toward long-term compliance is appointing someone to keep your business on track: a data protection officer (DPO). A DPO will oversee your organization’s data protection strategy. They can provide guidance on compliance, conduct internal audits, and help educate the rest of your team on proper privacy practices.

2. Map Your Data Processing Activities

What kind of data does your company collect? How and why is it processed? Where is it stored? Who has access to it, and when? A comprehensive data map helps in understanding the data lifecycle and identifying areas of risk.

3. Prioritize Privacy Compliance Actions

Based on your data map, identify areas of concern and prioritize the actions needed to achieve compliance. Restrict data access only to those who need it. Ensure you aren’t collecting more data than you should, and that your processing isn’t resulting in potentially discriminatory results.

4. Conduct Data Protection Impact Assessments (DPIAs)

Data protection impact assessments look at your data processing activities that present an elevated risk to individual privacy. (Examples might include processing biometric data or using an AI to help with data analysis.) These assessments should determine the potential consequences of each activity and identify specific weaknesses to focus on. Not only will this keep you in compliance with newly passed laws, but it also keeps your entire company’s data processing systems more secure in the long run.

5. Establish Internal Data Protection Policies

Whether it’s a data breach, a flood of DSARs, or something else, a sudden change to your normal marketing routine can make things spiral out of control without a plan. Your entire team should know the proper protocol for any possible situation.

6. Document Privacy Compliance Efforts

Finally, document everything. Privacy enforcement authorities can and will audit your business to ensure compliance. You should have records ready to show them that document your employee training sessions, DPIAs, privacy policies, and any other procedure that involves collecting or processing data. This will prove your commitment to compliance. More importantly, it can also help you avoid penalties.

As new privacy laws begin enforcement and your business expands into new regions, staying on top of your privacy compliance efforts is critical. The CNIL’s guidelines will put you on the path to success. But why stop there? Our flagship software, 4Comply, can help your marketing team make privacy compliance easier. Contact our team today to learn more.