C&L_December 2017 (1)

More documents

Recommendations

Info

Cover Story “In India, however, 7 out 10 BFSI organizations (handling EU customer data/business) we reached out to did not want to comment on their GDPR preparedness” The ABC of GDPR The General Data Protection Regulation (GDPR) is a law or a regulation, which was adopted by the European Commission on 27 April 2016. The GDPR applies to any organization, regardless of geographic location, which controls or processes the data of an EU resident in a proscribed way. It dictates to what extent personal data may be collected, the need for explicit consent to gather such data, requirements to disclose breaches of data and stronger powers to substantially fine organizations that fail to protect the data for which they are responsible. Applicability: Applies to entities — including third parties that are (i) established in the EU, (ii) providing goods or services to EU residents or (iii) are monitoring the behavior of individuals in the EU Building: Privacy-by-design principles must be incorporated into the development of new processes and technologies Empowering Consumers: Organizations Source: EY’s cyber and privacy insights document will have to facilitate customers’ and employees’ right to erasure (of data), right to portability, and an increased right of access. Fines: Up to EUR20 million or 4% of the organization’s total global revenue, whichever is greater; also provides individuals new rights to bring class actions against data controllers or processors, if represented by not-for profit organizations, which heightens litigation risk Reporting: Organizations will have only 72 hours to report data breaches Employing People: Most organizations will need to designate a Data Protection Officer and a Data Controller Storage: Organizations will have to maintain records of processing activities Security: Organizations will need to scale security measures based on privacy risks. Permissions: Explicit and affirmative consent will be required before processing personal data. For long, the fleeting mention of GDPR in India came up only at the time of reporting a security breach. Until in 2016, Indian regulators namely The Reserve Bank of India and Securities and Exchange Board of India (SEBI) issued frameworks to strengthen cyber security in the BFSI sector. “Banks, as owners of such data, should take appropriate steps in preserving the Confidentiality, Integrity and Availability of the same, irrespective of whether the data is stored/in transit within themselves or with customers or with the third party vendors; the confidentiality of such custodial information should not be compromised at any situation and to this end, suitable systems and processes across the data/information lifecycle need to be put in place by banks,” RBI explicitly highlighted in the framework under section subtitled ‘Ensuring Protection of customer information’. In September 2016, SEBI also asked commodity derivatives exchanges to put in place a framework to safeguard systems, networks and databases from cyber attacks. It also announced the appointment of a new Chief Security Officer who will be responsible for strengthening SEBI's regulatory policy framework in the area of cyber security. Going a step further in April 2017, the Insurance Regulatory and Development Authority of India (IRDAI) tightened the noose on CEOs and CMDs of all insurance firms, giving them a period of about a year to ensure that adequate mechanisms are put in place to address the issues related to information and cyber security. The icing on the cake this year was the Supreme Court's landmark verdict on the right to privacy. Additionally, India is now moving towards legislation on data protection. The central government had set up an expert committee to study the different issues relating to data protection in India and make specific suggestions on principles underlying a data protection bill. 10 CIO&LEADER | December 2017
Cover Story These frameworks may not significantly impact GDPR preparedness of companies in India. However, they will certainly keep up their customer data and security vigil. According to Parag Deodhar, Information Security Leader at a reputed financial services firm, headquartered in EU with subsidiaries spread across the globe, “We have been running a global project for GDPR compliance across the company and are tracking actions across subsidiaries and shared services.” The global financial services firm has shared services centres outside EU where data for EU is processed, and therefore, has to comply with GDPR. “We are implementing a data privacy and protection framework with global standards such as ISO / NIST etc. Our framework has been reviewed by reputed audit firms as well as regulators. We have incorporated their recommendations in our framework as well,” said Deodhar. In India, however, 7 out 10 BFSI organizations (handling EU customer data/business) we reached out to did not want to comment on their GDPR preparedness. However, all of them had heard of the regulation and its impact of their business, unlike a quarter (25%) of the 700 European companies surveyed by IDC Research on behalf of ESET, admitted they were not aware of GDPR and more than half (52%) of them were unsure of the impact on their organizations. Research firm Gartner, in a statement issued in November 2017, believes that less than 50% of all organizations impacted will fully comply by that date. The IT/ITes sector is the biggest contributor to India’s economy – with 66.1% contribution of services sector to GDP, “We have taken structured approach and Framework is in place to address GDPR needs.” Harshad Mengle Director – Cyber Security Capgemini Sogeti India “We supply 90% of our Metformin to European countries. We have employees as well as contractors across EU –and our Chief Compliance Officer in cooperation with IT security as well as the board – is creating a Standard Operating Procedure (SOP) to ensure how it is going to impact our business.” Jitendra Mishra VP– CIO, Wanbury the information technology – business process management (IT-BPM) sector serves as a major market for IT software and services exports are the U.S. and the U.K. and Europe, accounting for about 90% of total IT/ITeS exports. Given the criticality of IT–BMP services, “India must do all it can to protect and promote business in this sector. To a large extent, future of business will depend on how well India responds to the changing regulatory changes unfolding globally. India will have to assess her preparedness and make convincing changes to retain the status as a dependable processing des- December 2017 | CIO&LEADER 11
Page 1: Insight: Wither Supercomputing? Pg
Page 4 and 5: Insight: Opinion Feature Volume 06
Page 6 and 7: INTERVIEW "Hybrid cloud serves as a
Page 8 and 9: Interview Nitin Mishra, Netmagic co
Page 10 and 11: GDPR: The Countdown to New Regime W
Page 14 and 15: Cover Story tination,” - accordin
Page 16 and 17: Cover Story+ Towards an Indian Data
Page 18 and 19: Cover Story+ Whitepaper on Data Pro
Page 20: Cover Story+ Should there be strict
Page 23 and 24: Insight Measuring the Speed of Spee
Page 25 and 26: Insight AAutomation and intelligenc
Page 27 and 28: Insight AAs many as 96% of senior e
Page 29 and 30: Insight Worldwide IT Services Reven
Page 31 and 32: Insight mechanical systems. When da
Page 33 and 34: Insight D Don’t Fear AI Machine l
Page 35 and 36: Insight AAccording to 2018 Gartner
Page 37 and 38: Opinion WWe live in a time where te
Page 39 and 40: Opinion TTesla has already changed
Page 41 and 42: Feature IIn 1978, Transformational
Page 43: 100 Finance decision-makers of Indi

C&amp;L_December 2017 (1)

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?

C&L_December 2017 (1)