Five steps for better privacy in your business

GDPR (General Data Protection Regulation) has been part of Norwegian law for seven years already (lovdata.no). The experience so far is that many businesses find GDPR difficult to understand and challenging to implement in practice. Many therefore struggle to see through the "GDPR fog" – for what are actually the simple and effective measures to ensure that the company's digital products and services comply with the law and how do we organize this work?

‍

Here are five measures that both strengthen compliance with the law and improve the quality of the company's digital services.

1. Increase overall awareness within the organization

If the organization develops its own digital products, both privacy and product quality become significantly better when privacy is a natural part of both the development and management of these products.

If your organization procures digital products and services, those who order them must have the competence to set relevant and necessary requirements for suppliers regarding data privacy.

And remember - data privacy must be followed up over time – build it into the organization's routines and quality system.

2. Clarify roles and responsibilities

It is very important that it is clear who is responsible for the various aspects of data privacy within the organization. This applies to the responsibilities of management at various levels, as well as other roles such as developers, administrators, or procurers of digital services.

Internal users of products and services that process personal data must also understand their responsibilities regarding data privacy.

Especially in larger organizations, it is important to have dedicated roles for data protection officers (DPOs) and privacy advisors, and they should also have expertise in technology, organization, and law.