GDPR Compliance check for Ecommerce platforms
Suokannas, Ville (2019)
2019
Julkaisun pysyvä osoite on
https://urn.fi/URN:NBN:fi:amk-2019060615215
https://urn.fi/URN:NBN:fi:amk-2019060615215
Tiivistelmä
The purpose of this thesis project was to identify missing points from the company X’s electronic commerce platforms with regard to the new General Data Protection Regulation (GDPR). This was done by summarizing the main points of the GDPR, comparing the new regulation to the old one and auditing 2 platforms that the organization owns.
The knowledge base of this thesis report is based on interviews, case study research, the VAHTI auditing tool and best practices to adhere to the law.
The tests consisted of checking the compliance status of the 2 e-commerce platforms of the organization to uncover missing parts that are mandatory for the GDPR compliance. The first test found that the GDPR statement of the company was missing. As the aim is to be 100% compliant, the first test can be considered a failure.
As the research progressed, the compliance test uncovered areas that are missing from the platforms by comparing the platforms to the compliance list of the auditing tool that was used. These were noted and informed to the owners of the platform so that they could be implemented in compliance with the new regulation. In the second test the problems noticed in the first test were corrected, making these platforms compliant with the new regulation. The success ratio was 50%.
The communication between the platform owners and the researcher was good. Details provided by the interview gave clear picture on the working of the platform and the VAHTI tool assisted in making the test successful.
The knowledge base of this thesis report is based on interviews, case study research, the VAHTI auditing tool and best practices to adhere to the law.
The tests consisted of checking the compliance status of the 2 e-commerce platforms of the organization to uncover missing parts that are mandatory for the GDPR compliance. The first test found that the GDPR statement of the company was missing. As the aim is to be 100% compliant, the first test can be considered a failure.
As the research progressed, the compliance test uncovered areas that are missing from the platforms by comparing the platforms to the compliance list of the auditing tool that was used. These were noted and informed to the owners of the platform so that they could be implemented in compliance with the new regulation. In the second test the problems noticed in the first test were corrected, making these platforms compliant with the new regulation. The success ratio was 50%.
The communication between the platform owners and the researcher was good. Details provided by the interview gave clear picture on the working of the platform and the VAHTI tool assisted in making the test successful.