The Data Privacy Pack¶

How would an organization comply with data protection/data privacy regulation such as the European Union General Data Protection Regulation (GDPR)? This type of legislation can have far-reaching impacts on the way that the organization operates and an organization's response needs to be carefully planned and rolled out consistently across multiple groups within the organization - otherwise the organization may waste a lot of time and effort without actually becoming compliant.

The aim of the data privacy pack is to provide support to a person responsible for implementing data privacy in an organization. We refer to this role as the Privacy Officer.

The pack will eventually support the following phases in the Privacy Officer's work:

• Understanding the types of requirements that privacy legislation typically includes.

• Preparing and documenting definitions, classifications and related metadata to support privacy.

• Planning a Campaign (series of projects) to roll out changes to the organization and its IT systems to support privacy.

• Working with project teams on new uses of personal data (eg a new digital service or product offering that uses personal data).

• Assessing the current state of compliance.

• Rehearsing different scenarios such as data breach incidents and data subject requests.

• Reacting to/managing real privacy incidents as they occur.

The initial phase is to identify the roles and activities around the lifecycle of a digital service.

The data privacy pack is made up of documentation and pre-built metadata elements that can be loaded into an open metadata compliant repository and shared across an open metadata repository cohort. It is also driving changes into Egeria to provide specific privacy services through the Privacy Officer API.