Three Things to Consider when Setting Up Data Compliance

This article seeks to highlight three items that we consider to be important when it comes to #data compliance.

It is based on the work that we are doing to support organisations implement or strengthen data compliance systems. 

1. Apply the age-old #compliance frameworks when implementing data compliance.
 The framework is tried and tested and provides a useful implementation framework that covers:
- policies and procedures (including code of conduct and #ethics),
- effective #communication (hotline),
- training,
- compliance office (outsourced or in-house),
- #audit and monitoring,
- consequence/accountability management, and
- third party transactions.

You will note that registration with the Office of the Data Protection Commissioner (ODPC) is not listed as an element on its own.

Registration is a necessary but not sufficient aspect of compliance.

In fact, we consider registration, particularly the declarations made in that process, as exposing  organisations to compliance #risks relating to incorrect / misleading disclosures.

To illustrate, review the declarations made during registration, specifically the #data processing activities and technical measures, against actual practice. Do those declarations replicate existing structures and practices that support the declarations made or do we congratulate your firm for fulfilling yet another tick-box exercise?

2. Benchmark against global, not just local, legislation.

We live in a global village, and #Kenya is a regional hub. The probability that your organisation is processing other nationalities' data is high.

The ODPC is increasingly, based on last year activities, looking to the EU to develop jurisprudence on data compliance.

This is why, in designing 350-point MZIZI-Audit tool, we looked to gold standards in data compliance for inspiration.

The compliance team need to continuously update their understanding of these standards/emerging jurisprudence as part of their continous development.

3. Involve the ICT Teams.
Legislation does not exist in a vacuum. Data legislation seeks to influence how organisations process data. This data is stored in systems, and data may be baked into an organisation's business model.

Working without the technical teams is fruitlessly and can compromise / undermine compliance efforts, this is particularly clear when implementing privacy by design principles.

Our decision to work with an ICT consultant in this regard, was influenced by this.  

Conclusion

 Large organisations have specialist functions that deal with specific aspects of regulation with consolidation being achieved at the apex. Smaller organisations may not do this and so consolidating data compliance into the overall regulatory compliance framework of the organisation, whether or not this feeds into the enterprise risk management framework. 

Therefore, when conducting annual or regular legal audits, data compliance becomes a part of this regulatory risk management framework.
---
mzizi-africa.com
Compliance, simplified.

Comments

Post a Comment

Popular posts from this blog

10 Compliance Movies & Lessons

Learners have different learning styles. Visual learners will appreciate a good movie. In catering to visual learners, we have curated a list of compliance-related movies to cater to various code of conduct areas, along with their key cast members and key lessons: 1. Data Privacy: The Circle (2017) Cast : Emma Watson, Tom Hanks Key Lesson : The film explores the consequences of invasive surveillance and the importance of protecting personal data in the digital age. 2. Anti-Money Laundering (AML): The Infiltrator (2016) Cast : Bryan Cranston, Diane Kruger Key Lesson: AML agents play a critical role in uncovering illegal financial activities and bringing criminals to justice. 3. Corruption: Serpico (1973) Cast : Al Pacino, John Randolph Key Lesson: This movie depicts the real-life story of Frank Serpico, highlighting the challenges of exposing corruption within law enforcement. 4. Bribery: Syriana (2005) Cast : George Clooney, Matt Damon Key Lesson: The film explores the murky world of ...
Read more

Data Privacy Risks of Recycled Phone Numbers

Image
The Kenyan government launched the Gava Mkononi app this week. Against this backdrop, there are genuine concerns about steps being taken to safeguard citizen data.  Today, we review the risks associated with recycled phone numbers. Gava Mkononi and eCitizen The Kenya government has prioritised mobile phones in their digital services ambition to scale up access to government services from the current 400 to 5,000 by the end of the year. To that end, it is facilitating citizens' access to low-priced mobile phones through a local manufacturer and a leading telco. The Gava  M kononi service is an extension of the country’s eCitizen platform. The eCitizen platform uses SMS-based authentication where a single-use passcode (OTP) is sent to the subscriber's phone through a text message. Negative effects of recycled numbers More than ever, phone numbers are tied to people’s identities.  They are used to link online accounts (social media accounts, ridesharing apps, mo...
Read more

Cultivating Ethical Cultures through Technology: The Case for a Policy Management System

Image
  Digitizing policy management can help an organisation achieve culture change through accountability. A digital system provides a centralized, automated, and transparent approach to policy and procedures management that is very supportive of accountability frameworks.  Here are some ways to achieve accountability using a digital policy management system: 1. Centralized policy management : A digital system allows an organization to store all its policies and procedures in a single, central location.  This ensures that all employees have access to the most up-to-date policies and procedures, reducing the risk of non-compliance due to outdated or inaccessible policies. 2. Automated policy updates and notifications : A digital policy management system can automatically update policies and procedures and notify employees when changes are made.  This ensures that employees are always aware of changes to policies and procedures, reducing the risk of non-complianc...
Read more