Group data pro­tec­tion with se­cur­ity

Data pro­tec­tion in an in­ter­na­tion­al group is a chal­lenge. Sub­si­di­ar­ies that operate glob­ally are subject to dif­fer­ent data pro­tec­tion laws. Many ap­plic­a­tions, pro­cesses and service pro­viders are used through­out the company and thus gen­er­ate transna­tion­al data flows. Without a process-based data pro­tec­tion or­gan­isa­tion that func­tions ac­cord­ing to uniform prin­ciples, there is a lack of over­view and ef­fi­cient control options.

Data pro­tec­tion as part of the com­pli­ance man­age­ment system.
At Evonik, data pro­tec­tion is a central com­pli­ance issue with high pri­or­ity. Long before the GDPR, those re­spons­ible im­ple­men­ted a system that anchors data pro­tec­tion in all rel­ev­ant company pro­cesses. A data­base solu­tion de­veloped in-house sup­por­ted the data pro­tec­tion officer and his team in cre­at­ing and main­tain­ing the re­gister of pro­cessing activ­it­ies.

The team used another data­base to map the data pro­tec­tion or­gan­isa­tion and doc­u­ment­a­tion. This method worked well, but reached its limits in the course of the changeover to the GDPR. The goal: Replace the old system with a central data pro­tec­tion man­age­ment soft­ware that im­proves ef­fi­ciency and over­view and offers a way to doc­u­ment doc­u­ments up to the highest con­fid­en­ti­al­ity class.

En­cryp­tion as an im­port­ant se­lec­tion cri­terion.
After a se­lec­tion process, Evonik decided to use otris privacy for data pro­tec­tion within the group. An im­port­ant se­lec­tion cri­terion: the im­ple­ment­a­tion of an en­cryp­tion stand­ard within the soft­ware, as well as the trans­fer of the company-spe­cif­ic data pro­tec­tion pro­cesses.

Doc­u­ment­a­tion and in­form­a­tion man­age­ment.
Evonik uses otris privacy to map its data pro­tec­tion or­gan­isa­tion. This in­cludes doc­u­ment­a­tion on the one hand and pro­cesses that control pro­cessing on the other. Example: The central doc­u­ment­a­tion is the dir­ect­ory of pro­cessing activ­it­ies (VVT). otris privacy con­trols the cre­ation of new pro­cessing activ­it­ies and the in­teg­ra­tion of process owners through pre­defined process steps. Other aspects that Evonik handles with otris privacy: Doc­u­ment­a­tion of re­quests, doc­u­ment­a­tion of service re­la­tion­ships, man­age­ment of sample doc­u­ments/con­tracts/for­mu­la­tions, as well as all in­tern­al team doc­u­ment­a­tion. In ad­di­tion to doc­u­ment­a­tion, Evonik also uses otris privacy to manage in­form­a­tion, train­ing and ap­point­ments rel­ev­ant to data pro­tec­tion (further train­ing, cer­ti­fic­ates, pub­lic­a­tions by the su­per­vis­ory au­thor­it­ies, news re­lat­ing to data pro­tec­tion, project work, data pro­tec­tion advice and ap­point­ments).

Re­port­ing
Another benefit of central, uniform data storage is the ease with which activ­it­ies and pro­cesses can be eval­u­ated. Evonik uses the otris privacy cockpit for the in­di­vidu­al pre­par­a­tion of data ma­ter­i­al. The system auto­mat­ic­ally gen­er­ates reports for in­tern­al and ex­tern­al re­port­ing ac­cord­ing to pre­defined para­met­ers. On the one hand, this im­proves the in­tern­al mon­it­or­ing of data pro­tec­tion activ­it­ies. On the other hand, the or­gan­isa­tion is able to provide in­form­a­tion at any time and main­tains an over­view in terms of ac­count­ab­il­ity.

Current and Future Use
Cur­rently, the five-member cor­por­ate data pro­tec­tion team is the main user of the solu­tion. The de­cent­ral­ised data pro­tec­tion co­ordin­at­ors and data pro­tec­tion con­tacts in the de­part­ments also use the system in varying degrees of in­tens­ity. The main focus of otris privacy is on the head office and the German com­pan­ies. The suc­cess­ive trans­fer of the EU com­pan­ies to the system is un­der­way.