This document will outline how General Data Protection Regulation (GDPR) affects Halo Service Desk, and customers of Halo Service Desk; including what action we have taken in response, and the information you need as a customer of Halo Service Desk to best comply with these new laws coming into force on May 25th, 2018.

Introduction

The European Union has taken a monumental step in protecting the fundamental right to privacy for every EU resident with the General Data Protection Regulation (GDPR) which will become effective from May 25th, 2018. Simply put, EU residents will now have greater say over what, how, why, where, and when their personal data is used, processed, or disposed. This rule clarifies how the EU personal data laws apply even beyond the borders of the EU. Any organization that works with EU residents’ personal data in any manner, irrespective of location, has obligations to protect the data. Halo Service Desk is well aware of its role in providing the right tools and processes to support its users and customers meet the compliance standards.

Halo Service Desk’s Commitment

At Halo Service Desk, we have always honoured our users’ right to data privacy and protection. We have never relied on advertising as a revenue stream. We have never served ads to our users, and never will. This means that we have no necessity to collect and process users’ personal information beyond what is required for the functioning of our products.

Over the past 20+ years, we have demonstrated our commitment to data privacy and protection. We already have strong Data Processing Agreements, and we are revising them to meet the requirements of the GDPR. We recognise that the GDPR will help us move towards the highest standards of operations in protecting customer data.

How is Halo Service Desk preparing for GDPR?

The Halo Service Desk product has been developed since 1994, meaning we have over 2 decades of experience in the industry. We have 40+ on-premise and cloud applications used by 100,000+ in over 40 countries. Halo Service Desk is gearing up to be GDPR compliant across all of its applications, by the time the regulation comes into effect. As a data processor, Halo Service Desk understands its obligation to help customers get ready in a timely manner. We have taken the time to thoroughly analyse GDPR requirements and have put in place a dedicated internal team to guide our organisation to meet them. Some of our ongoing initiatives are:

• Identifying personal data – Each of our 40+ different applications undertakes a different level of personal data collection, usage, storage and disposal. Defining the purview of personal data for each of these applications and documenting the various sources of data will go a long way in providing a roadmap for compliance in the days leading up to the implementation.
• Providing visibility and transparency – The most important aspect of GDPR is how the collected data is used. As a data processor, Halo Service Desk’s key role is to provide our customers (the data controllers) with the access to effectively manage and protect their user data. Halo Service Desk is exploring ways to make optimal product enhancements without compromising on performance so that we can provide better transparency to our customers.
• Enhancing data integrity and security – Data privacy and data security are closely linked. As our customers tighten their data security measures, Halo Service Desk would like to extend a helping hand. We’re streamlining the processes for our cloud applications by implementing IT policies and procedures that provide end-to-end security.
• Portability and transferability of data – GDPR gives end users the right to either receive all the data provided and processed by the controller or transfer it to another controller depending on technical feasibility. With this new right in mind, Halo Service Desk is working on further enhancing its data exporting capabilities to enable export even at the individual level.

What does this mean for our customers?

We understand that meeting the GDPR requirements will take a lot of time and effort. And as your partner, we want to help you make your process as seamless as possible so that you don’t have to worry about compliance and allow you to focus on more important matters.

Depending on the type of agreement you have with us, this will have different implications to how GDPR will affect you:

Cloud Purchase: If Halo Service Desk hosts your help desk, it will be on your own dedicated server – ensuring optimum performance and security. All of your information will remain secure and only accessible by those you give permission to. For GDPR, you will benefit from our enhanced reporting service for any activity taking place on our servers. With our secure AWS Servers, you can be rest assured your European Citizen data will be based out of the UK in compliance with GDPR.

On-Premise Purchase: If you Benefit from installing HaloITSM onto your own servers. Then you will still be able to benefit from the additional features coming in to help you comply with GDPR.

If you wish to upgrade to our hosted service to benefit from increased security and monitoring capability, please contact: sales@HaloITSM.com

Some of our product enhancements are about to make it easier for you to:

• Provide access controls
• Encrypt, anonymize or delete user data
• Perform data audits or assessments using data processing logs
• Create provisions for data subjects rights
• Enhance security for user data

What should you do to be GDPR-ready?

If you are just getting started with GDPR compliance in your organization, here’s a quick to-do list to keep in mind.

• Create a data privacy team to oversee GDPR activities and raise awareness
• Review current security and privacy processes in place & where applicable, revise your contracts with third parties & customers to meet the requirements of the GDPR
• Identify the Personally Identifiable Information (PII)/Personal data that is being collected
• Analyse how this information is being processed, stored, retained and deleted
• Assess the third parties with whom you disclose data
• Establish procedures to respond to data subjects when they exercise their rights
• Establish & conduct Privacy Impact Assessment (PIA)
• Create processes for data breach notification activities
• Continuous employee awareness is vital to ensure continual compliance with the GDPR

For any requests for further information, to exchange Data Processing Agreement (DPA)’s and urgent reporting requests, please contact us: communications@haloitsm.com