The General Data Protection Regulation (GDPR) was adopted in April 2016 and applies directly and uniformly across the European Union. It replaces the 1995 Personal Data Protection Directive in EU law and supersedes the provisions of the French Data Protection Act of 1978. The European Union therefore benefits from a single harmonized framework, fully applicable since May 25, 2018.

One major change mandated by the Regulation is the requirement to appoint a Data Protection Officer (DPO). In the public sector, this requirement applies to central government departments, decentralized bodies, and local authorities alike. In the private sector, organizations whose core activities involve the large-scale processing of personal data must also appoint a DPO.

In an increasingly data-driven economy, this requirement impacts a very large number of organizations.

4 steps to compliance

The GDPR training delivers an up-to-date overview of the mandatory requirements and operational tools in effect since May 2018, enabling your organization to initiate its compliance roadmap without delay. This training is designed for DPOs, CIOs, CISOs, as well as Quality and Compliance Managers.

Methodology

• Instructor-led training
• Hands-on application through interactive workshops
• Training delivered by an ITrust legal expert

The training is conducted entirely in French, with course materials provided upon completion.

The objective of this phase is to evaluate current posture against GDPR requirements and establish an actionable remediation plan.

Methodology

ITrust applies the documentary methodology defined by the CNIL, structured into several key phases:

• Kick-off meeting
• Gap analysis
  • Documentary review (contracts, IT charter, internal regulations, security policies, BCP/DRP, etc.)
  • Technical audit
  • Identification of risk scenarios
  • Interviews with information systems managers to establish an inventory of personal data processing activities classified by sensitivity level and analyze cross-border data flows.
  • Assessment of existing or planned security controls
• GDPR compliance assessment and remediation action plan

Leveraging the audit findings and data mapping, ITrust supports you through the implementation of your GDPR compliance roadmap defined in the previous phase.

Methodology

ITrust applies its specialized expertise to ensure client compliance across legal, organizational, and technical controls (ISO 2700x, EBIOS, EIVP, PCI DSS, GDPR, RGS, security certifications, PSCO, etc.).
ITrust can support projects such as:

• Data privacy policy and coordination between key stakeholders (including the DPO): accountability, internet usage, IT charters, contractual updates, etc.
• Organizational processes across the full data processing lifecycle. Examples: privacy by design, personal data purging, subject access request (SAR) workflows, etc.

ITrust enables organizations to leverage their GDPR compliance posture with employees, clients, prospects, and business partners. Demonstrating strict adherence to these regulatory standards delivers a tangible competitive advantage.

Methodology

• Staff security awareness initiatives, delivered company-wide or tailored by business function
• Alignment of internal documentation (internal policies and IT charters) in coordination with employee representative bodies

• Highlighting personal data protection within Corporate Social Responsibility (CSR) initiatives
• Guidance and assistance in obtaining the CNIL governance certification