The Dilemma of GDPR, Governance, Risk Management, Compliance and IT-Security Disruption.

agenda. Timings: 09:00 to 16:30 Central European Time (CET)

ALL DAY SESSION ON CURRENT, TOPICAL AND TIMELY GRC, GDPR and DPO ISSUES

08:30-09:00	Registration and Initiation

09:00-09:10	Welcome & introduction to the GRC, GDPR and DPO Sessions Opening remarks from the conference chairman Lady Olga Maitland

09:10-09:40	Top Operational Responses to GDPR, Data Privacy and Data Protection What to Do and When Dealing with Whistleblowing under the GDPR Adv. Lorenza Villa, Lawyer - GDPR, DPO, RSPP e Sicurezza sul lavoro

09:40-10:20	The Risk Gaps and the Impact Of Digitalization To The Organisation, Employees And the Society Digital technologies make employees digital nomads, with an alleged increase in flexibility. How do they feel about this change? What are the gaps, fears and feelings and increased human-related risks? Emmanuel Fragnière, Professor, HES-SO Valais-Wallis University of Bath, School of Management

10:20-11:00	Cognitive Diversity for Better Conduct: Identifying and Reporting on the Human Risk Factors Prof. Dr. Roger Miles, Cambridge University, Judge Business School, and Hazards & Risk Research Group at King’s College London

11:00-11:40	Minimising Privacy Risk from A Global Data Processor’s Perspective DPO, Controller or Processor? – (and the risk of mixing roles) Minimising the aggregate privacy risk vs contract sharing Using a Data Processor modular data- mapping and flows Leveraging Binding Corporate Rules as Data Processor David Gyori, CEO, Banking Reports

11:40-12:20	Strategic Vendor Risk Management for Privacy Pros How shared risk exchanges make vendor risk management more efficient What vendor risk activities to outsource and what to do in house Breakdown How to pick the right risk assessments and methodologies for your organizations How privacy professionals can cross collaborate with their broader infosec and procurement teams Jacob Eborn, Privacy Consulting Manager, CIPP/E, Onetrust

12:20-12:50	Transitioning GDPR from a Compliance Checklist to ‘Business as Usual’ Understand how to shift GDPR compliance efforts from a one-off activity into BaU Take home a step-by-step approach to ongoing GDPR compliance within your company How current GDPR efforts can set up for success with other global privacy laws Darine Fayed. General Counsel & DPO @ Mailjet

12:50-14:00	The Post-Brexit Landscape for Governance and Compliance The primary corporate concerns of the Brexit for the UK and the EU Panellists: Georgina Wright, Senior Researcher, Institute for Government; David Doughty CDir FIoD FCIM; Claus Andersen, Partner, Corporate & International, Royds Withy King; Gareth Garvey, Director, British Chamber of Commerce. Moderator: Lady Olga Maitland, Chairman, Copenhagen Compliance UK Ltd, Ex-Member of Parliament and Jr. Defence Minister

14:00-14:20	Post-GDPR Effects and Issues GDPR landscape in European jurisdictions Enforcement actions against EU companies under the GDPR; Guidance issued by local regulators touching on DPIA and Data Protection Officers Prof. Hernan Huwyler, CPA, MBA, Head of Compliance Strategy, Danske Bank

14:20-14:40	The role of Internal Audit during Pandemic times Burzin Dubash. Partner Deloitte

14:40-15:00	Emerging Governance, Risk and Compliance Issues That Boards and Executive Teams need to act on Understanding the reasons why many data, digital, cloud and transformations fail or do not reach aspirations Defining a future pathway to success in GRC David Dalka, CEO, Board Change & Strategic Planning Advisor, Fearless Revival

15:00-15:40	Shifting cybersecurity from a compliance to a risk focus Nick Frost, Co-Founder and Director, CRMG Greg Slayton, Client Partner, Galvanize

15:40-16:10	How Can ISO 27701 Help to Designing, Implementing, Operating, and Improving GDPR Compliance Applications for the new ISO 27701 for GDPR and DPA compliance Key control objectives, requirement based on the ISO 27001 on information security How to prepare for an independent certification Prof. Hernan Huwyler, CPA, MBA, Universidad Internacional de La Rioja, Danske Bank

16:10-17:00	Panel Discussion and Q/A session: Each speaker will address one of the following issues Identifying the threats to an organization Identifying important business systems and assets Understanding the new technology for digitization and Transformation Leadership in managing Cybersecurity risk as a business risk Incident response and accountability Designing and implementing a GRC/GDPR and IT security mitigation strategy All speakers

Boost your knowledge and address the GDPR challenges at the workshop

Our deep-dive workshops will improve, refine and sharpen your hands-on capabilities on the data you need to address the GDPR challenges. You can participate in the 13th annual GRC and IT Security Summit or register for the GDPR Bootcamp separately.

This workshop will provide the techniques for implementing or updating the compliance program to fit your organisation. The primary components of the workshop are:

IT Security and Data Breach

How can we prevent abuse or misuse of personal data
How do we address violations
What are the remedies that we use to correct the faults and errors?

Privacy by Design: Understanding the Mandates and The Practical Dimensions

What are the legal basis of IT and cyber security compliance in the organisation
How to ensure consistent consent from data subjects to secondary processing
The review of the audit process for implementing change in processing personal data?

Data Privacy Impact Assessments: The Full Picture

How should regularly reviews of the data and process (regular data flow mapping, audits, risk assessments and reviews) to ensure the legal basis has not changed
How is the personal information is collected and used?
Do we use data exactly for the purpose it was collected

Top Operational Responses to GDPR: What To Do and When

We walk through a couple of step-by-step experiences.

The realities of data breach notification and responses require exceptional in-house communication (with information on what to do before, during, and after an incident occurs) to prepare the organisation for a violation, handle tricky multi jurisdictional legal notices.

Therefore, if you are uncertain that your team is ready for the biggest European data protection reform in 20 years, this workshop will help you prepare. The two experts together with an IT Security manager offer a practical, hands-on view of the essential assessment of the GDPR with knowledge about key concepts, scope of application, individual rights, core principles, compliance in practice, accountability, data protection impact assessments and more.

Key takeaways:

The immediate actions to take when presented with a potential data breach
How to handle cyber security and lower the risks and exposure to IT and data breaches
Regulatory Developments; Info security, Trans-Border Data Flow,
Learn practical techniques for implementation of a privacy program fitting your organisation
Learn from two industry veterans who will help highlight the differences between the new regulation and earlier directives

Bootcamp moderators; Alan Calder, CEO IT Governance and Kersi Porbunderwalla Secretary general Copenhagen Compliance UK Ltd.

DPO Day

IT Governance Issues

How To Prepare For The Data Breach And The Ethics Breach

Break down the difference between a data breach and an ethics breach.
Define the key insights from recent data breaches and learn how to avoid these mishaps
Gain an incident and breach toolkit to prepare the organisation ahead of a breach

Developing GDPR and Data Privacy, Data Protection Policies

The structural basis of the GDPR Policies, procedures and Frameworks
GDPR as a platform for improving IT Concepts
Developing Privacy as a competitive advantage- leveraging the investment

Post-GDPR Effects

Post-GDPR landscape in European jurisdictions
Enforcement actions against EU companies under the GDPR;
Guidance issued by local regulators touching on Data Protection Impact Assessment and Data Protection Officers

Guidance Issued By Local Regulators And Review Of The Latest GDPR Publications:

Data Protection Impact Assessment and Data Protection Officers
EDBP Guidelines on certification
European Cybersecurity Act incl.
European Cybersecurity Certification Framework

Establishing Data Privacy Culture & Risk Assurance

Embedding privacy culture within the company & privacy by design measures;
Conducting privacy impact assessments;
Risk management at the corporate group level

GDPR Compliance Issues

Case Study; Overview Of GDPR Project At Company ABC

The Key Compliance challenges
The Corporate perspective vs Client point of view
Important Implementation Lessons Learnt

GDPR 2.0 – Supporting The GRC and IT Security Momentum

Best practices in data management and Security
DPO 2.0 The journey continues...
Disclosures and Notification obligations beyond GDPR

How to Harmonise Data Protection In A Diverse Context?

Diverse context (multiple businesses, entities, territories, authorities/ DPAs, control approach, etc.)
Networking and stakeholder’s coordination
Approach on cross-context DP processes (DPIAs, data breach, DPA request, etc.)
Generate trust through 3rd party assessment

Moving GDPR From Programme Implementation to Business as Usual

Two-year GDPR programme transition is needed
Embedding and integration of Risk Management processes is essential
Continued focus and management attention for success is critical

GDPR Risk Management Issues

GDPR And Pseudonymization Solutions – Enabling Further Processing And Lowering Risks

General legal and organisational requirements for pseudonymization examples
Data protection focus group on pseudonymization
How to eliminate the risk of Data Breach with Intelligent Pseudonymisation of Personal Data

GDPR; The Solutions and Processes for Lowering Risks

The need for further processing for analytical and other big data processes
The need for risk reduction
Risk Assessments: The Touchpoints

Minimising Privacy Risk From A Global Data Processor’s Perspective

DPO, Controller or Processor? – (and the risk of mixing roles)
Minimising the aggregate privacy risk vs contract sharing
Using a Data Processor modular DPIA and data flow
Leveraging Binding Corporate Rules as Data Processor

GDPR Cyber-and IT Security Issues

Responding to Data Breaches – The Different (Lawyer, Corporate, Oversight) Perspectives

Regulatory guidance and evolving practice under the GDPR
The thresholds for notification requirements under the GDPR
Legal considerations: Privilege, self-incrimination
Contractual aspects and insurance

Privacy and Data Protection in The Age of Big Data & Algorithms

Big data & privacy: main challenges
Privacy and security by design as the way forward in the age of big data
Big data and algorithms: challenges and opportunities

Ensuring Privacy and Concealing Biometric Data

Concealing biometric PII with de-identification
PII from facial recognition to avoid identity theft
Privacy challenges in the age of facial recognition
Lessons from the latest incidents involving facial recognition misuse
Methods for dealing with AI-driven facial recognition

GDPR; How Can the Assessment of IT And Technical Measures Generate Trust