GDPR has been one focus of my work for over a year, and the level of interest in GDPR compliance has exploded in the last couple months. Lots of people are now scrambling to try to meet the end of May deadline, motivated often by their interactions with their business partners who are also working on compliance.

I've spent a lot of time interacting with potential clients lately where I feel like I'm successful in educating them on how big this GDPR work normally is. But the end result is usually that I convince them to either hire someone willing to do short-sighted work (and, in my opinion, waste their money AND increase their risk). Or they end up deciding not to do anything.

Hopefully, this information will be of benefit to anyone who has any kind of GDPR work to do but isn’t familiar with GDPR or maybe even formal privacy management. And hopefully, those who reach out to me about their projects will do so knowing that I’m going to tell them there’s no GDPR easy button.

To better serve anyone who may contact me regarding their compliance needs in order to figure out whether I am the right person to work with, I just posted a high-level compliance program overview diagram to our site's new Resources page.

(Don't worry—the picture above is NOT it.)

The diagram will show you the approach I normally take to the compliance consulting work I do, whether that is creating documentation, helping define governance processes, or dealing with awareness training needs for staff and other stakeholders.

The diagram illustrates the high-level lifecycle for creation of a complete, new compliance program.

This is the first in a small series on some key reasons why written policy and procedure documentation is important to your small business or medical or dental practice, no matter how small you may be.

Not many of the smallest businesses that I commonly work with have yet to purchase cyber insurance but it's becoming more popular, quickly, especially with data-intensive businesses and those facing clear and strong information protection rules such as HIPAA-regulated healthcare entities and even their business associates.

When it comes time to purchase cybersecurity insurance, odds are that you will be expected to have a defined compliance program that includes comprehensive written privacy and security policies and procedures.

It isn’t uncommon for businesses to have real rules and defined procedures that impact compliance but that are not written down. You could have a valid compliance program that is not all in writing.

I won’t be trying to convince people that they absolutely HAVE to spend money and precious time documenting businesses policies and procedures to satisfy a regulator who may have little likelihood to pay them a visit.

But there are several other reasons why small business owners should spend their money and someone’s precious time to create at least a basic set a business policies and procedures for their business or healthcare practice. And they're reasons that usually have bottom-line financial impacts.

This is the first of our ongoing “use case” blog posts, where we take off from a real news story to explore key compliance principles. For a more detailed explanation of how our posts tagged with the “use case” label will work, see our other post from today.

This first “use case” post is interesting because it illustrates just how universal the need for a compliance program can be. And it shows a key way you might figure out what to include in your own compliance program, by looking at what outsiders (whether regulators, auditors, or, as in this case, researchers focused on your product or industry) may use to investigate your industry. It also touches on the benefits of simplification in the face of a slate of differing regulations.

I used to say I got my start in privacy and compliance in 2002 when I moved out of technical writing and IT consulting; but a while back I found evidence to disprove that assertion, when I found the complete policy and procedure that I wrote in 1984 to govern how my high school's homecoming festivities were going to work.

It's now official. Cover Compliance LLC is now my sole, full-time gig. Now if my web designer will just treat me right, we'll be live online soon. —gm

Okay, NOW it's starting to get real. After 2 months of working with a diligent, but rather inefficient web designer, we've decided to go live with the site. We still need to get all the detailed content populated to our pages in the Services section, but that's coming along fine and should be added soon.