DAPROCADE

The biggest change brought by General Data Protection Regulation (GDPR) is accountability as a compliance principle. Regulated entities “shall be responsible for, and be able to, demonstrate compliance with principles relating to processing of personal data”. More precisely, companies are now obliged to implement appropriate and effective measures” to protect the rights and freedom of natural person, but also to be able to demonstrate that these measures are effective over time.
DAPROCADE is a Data Protection Governance solution allowing to monitor, improve and demonstrate the extent to which the measures implemented to protect the personal data are appropriate and effective.

The DAta PROtection CApability DEtermination (DAPROCADE) solution is an assessment framework used to determine whether technical and organisational measures implemented to preserve privacy are appropriate and effective. Adapted from quality requirements evaluation approach developed in the field of software and system engineering and standardized under ISO/IEC 330xx series of standard, the DAPROCADE solution (Figure) is a turnkey solution composed of:

• A GDPR Process Model
• An Assessment Method
• A software tool, supporting the Assessment Method and embedding the GDPR Process Model

The GDPR Process Model is a process assessment model that meets the requirements of ISO/IEC 33004 and that supports the performance of an assessment of process capability using the process measurement framework defined in ISO/IEC 33020.

The Assessment Method uses the generic approach for process assessment published by the ISO in ISO/IEC 33002. It can thus be used to assess processes from any field of activity (IT or business). Indeed, a process assessment is conducted to understand the current state of practices in an organization in a specific domain. The goal is to compare these practices to the state-of-the-art or to a standard so that the processes can be measured and appropriate suggestions for improvement can be made. The Assessment Method enable to size the assessment effort based on the available resources and the required level of confidence on the results while keeping a rigorous approach for the assessment.

The Assessment Method consists in an exhaustive explanation of how to perform a process assessment, including a detailed description of the phases, tasks, roles, inputs and outputs of such assessments.

The DAPROCADE solution includes an IT solution supporting the work of the assessors during all the phases of an assessment project. The tool was designed to enable cost-effective, quick, and repeatable process assessments. It can be deployed on premises or as a cloud-based software-as-a-service (SaaS) solution. The tool permits to automate key process assessment activities including assessment data collection, analysis, and reporting