Framework for assessing the GDPR data compliance

The General Data Protection Regulation is a new privacy legislation replacing the obsolete Data Protection Directive 95/46/EC from 1995. The Regulation introduces substantial changes in personal data protection and demands the compliance with its principles and rules. This lays new challenges on companies since the complexity of the new Regulation cannot be easily grasped and implemented. In this light, the demand for new aids increase as companies are willing to go through the preparation and implementation phases as quick as possible in order to prevent high financial costs. The aim of this master thesis is to design a framework for reviewing the current level of a company’s compliance with the GDPR requirements. The design of the framework is based on the key principles and rules of the GDPR, which are examined in the theoretical part of this thesis. Additionally, the thesis provides a summary of the most relevant steps a company should undertake in order to reach compliance. The thesis also pays attention to the implementation of the GDPR and researches the existing approaches to the implementation process. The theoretical part closes with the description of the specific compliance tool – Ness GDPR Governor, which served as a basis for the framework. The practical part aims at the creation of the framework design and its evaluation using a case study method.