GDPR Readiness: Getting the Message Out

Creating a Communication Plan Once good privacy policies and procedures have been developed, you need a solid plan to communicate this information to everyone in your organization. Even the most complete and well-written policy cannot be effective if the people around you have never been made aware of it. A clear communication plan ensures that every member of your organization is properly informed. Your plan should address four key components: **who, why, what, and how**. **Who** — Begin by listing who in your organization needs to be communicated with. Every member should be represented in some form. You can organize your list by individual employee, by department, or by division. **Why** — Next, identify why each separate group of employees needs to be informed. The reason might be to meet a new legislative requirement, such as GDPR compliance, or to communicate changes to an existing policy. **What** — Write out exactly what will be communicated with each group. This could be a new procedure, a certificate, a schedule, or a general announcement about privacy responsibilities. **How** — Finally, determine how this information will be delivered. There are many potential methods of internal communication, each with its own benefits and drawbacks. The method you choose must be accessible to your intended audience. Options include email, intranet posts, team meetings, printed notices,