Evan Levy, V.P. Services at SAS Global Data Management presented at SAS' "Supporting GDPR in a Data Driven Organization."

Evan pointed out that the GDPR is just the first effort to give the rights of personal information back to the individual. As such, it's best practice to establish a core responsibility for the people who have your information so they respect its importance and the detail of the data.

Perhaps if companies had this sort of mentality 20 years ago, CRMs would be much more effective that they are today. Companies put very little planning into place with regards to data.

IT strategies define tools, platforms, development, and approaches. Most organizations have no data strategy. This may be why companies are having trouble realizing real business value from Big Data and IoT initiatives.

Evan suggested a plan to improve all of the ways companies acquire, store, manage, share, and use data:

1. Identify: Be able to identify data and understand its meaning regardless of its structure, origin, or location. Invest in a metadata dictionary. Ensure everyone knows what's PII.

2. Provision: Enable data to be packaged and made available while respecting all rules and access guidelines. Consider how the data is packaged and consider platform access, tracking, and acceptance. Think about developers versus users and partners.

3. Store: Persist data in a structure and location that supports access and processing across the enterprise. Think about application-based data versus raw, cooked, and plated data; how you will onboard the data; how you will navigate and access the data; how you will catalog the data; and how you will manage changes to the data.

4. Integrate: Moving and combining data residing in multiple locations and providing a unified view of the data. Know how to identify and match, correct, implement identity rules, enforce adoption of taxonomy and analytics, and reference data.

5. Govern: Establish and communicate information policies and mechanisms to ensure effective data use with policies and rules, data security requirements, data quality standards, and data management oversight.

Evan suggests looking at the GDPR as an integral part of your data strategy rather than a one-off initiative. PII and personal data isn't limited to reporting and data delivery; it needs to be considered throughout the integrated data strategy.