Anthony Nolan

Anthony Nolan is a pioneering charity that saves the lives of people with blood cancer. Every day they use their register to match individuals willing to donate stem cells to people who need lifesaving transplants. Founded over 45 years ago, Anthony Nolan also conducts world-class research into stem cell matching and transplants, so they can make sure every person receives the best possible match. Today, there are over 730,000 potential donors on the Anthony Nolan register and the charity helps three people each day find that lifesaving match.

Anthony Nolan works with donors, potential donors and patients and the charity understands that privacy needs to be embedded into every aspect of their business.

“We couldn’t do any of our lifesaving work without trust – from donors, patients we help or our fundraising supporters,” said Danny Attias, Chief Information Officer at Anthony Nolan. ”Without trust donors would not join the Anthony Nolan stem cell register and we would not be able to give people in need of transplants a second chance of life.”

Building privacy as part of the Anthony Nolan DNA

Data protection has always been an integral part of Anthony Nolan’s operations, however, the GDPR shifted the perspective to make privacy a focus and a priority for everyone at the company. “Culturally, the GDPR reinforced our approach to protecting personal information with our senior leadership and trustees,” said Attias. “More visible value was put upon the importance of protecting the data that we process.”

The GDPR gave the charity an opportunity to trigger a process of data mapping, assess risk and review policies, bringing privacy to the front of everyone’s minds at Anthony Nolan. As they approached their privacy program strategy, the Anthony Nolan team began with data mapping. This was where the company saw the need for a platform to help consolidate the large amounts of data that they process.

“As a single exercise, we could do data mapping ourselves,” said Attias. “But if we wanted to burn it into the culture and have it as an evergreen arrangement where it’s continuously up to date, and we want to be able to reference it and help it drive decisions, then we needed a platform.”

Beginning their search in the market specifically for a data mapping tool, Anthony Nolan was pleased to find that OneTrust could not only complete their data mapping, but other aspects of their privacy program as well.

“When we looked at the market we assessed a variety of solutions, and then we came across OneTrust,” said Attias. “The platform was fresher, more agile, and easier to engage with. We took a holistic approach to choosing a supplier and didn’t just want a product. OneTrust looked like a company that we wanted to work with.”

Matching with OneTrust to automate comprehensive privacy efforts

When the Anthony Nolan team began the data mapping process they left no stone unturned as they analyzed and assessed the data flow across the organization. “OneTrust made the data mapping process significantly easier for us,” said Attias. “I was able to go into the dashboard, see where we are, how we were progressing data, what the information was, the level of collation and any duplication.”

As a result, they continued to explore the OneTrust tool, and advanced their privacy program with OneTrust’s Data Mapping Automation, Readiness & Accountability, PIA & DPIA Automation, Cookie Consent and Website Scanning and Data Subject Rights Management.

“At that time, we had several consultancies pitch us to help structure our GDPR readiness program. We found the simplicity, and clarity, of OneTrust’s Readiness Assessment Tool gave us the structure we needed to deliver our privacy program,” said Attias. “We used it as our primary tool, and the foundation for our GDPR program.”

It was important to Anthony Nolan that they establish the automated use of legitimate interest assessments and privacy impact assessments (PIAs). As a charity, Anthony Nolan relies on legitimate interest for processing data, so it was very important for them to have a user-friendly solution that everyone at the organization can use.

In addition to Data Mapping, the Readiness & Accountability tool and PIAs, Anthony Nolan is using OneTrust for marketing efforts including Data Subject Rights Management and Cookie Consent and Website Scanning. They can automate the full process for data subject access requests to make it readily accessible and verifiable within OneTrust. With OneTrust’s Cookie tool, visitors can granularly opt in or out of cookies and the company can keep records of a user’s consent.

Moving forward, Anthony Nolan is looking to implement the OneTrust Incident & Breach Response solution to streamline the process for incident and breach notifications.

“Because of OneTrust’s rapid development cycle, they are very responsive when we put in feature or change requests, and we saw those requests directly make their way into the product,” said Attias.

Registering a tool to grow with data protection efforts

As Anthony Nolan continues to develop their privacy program, they appointed a fulltime data privacy manager to maintain and enhance their data protection process. “We have definitely raised the bar for data protection across the organization,” said Attias. “Data protection is becoming a part of our culture, and this continues to be an ongoing process.”

Anthony Nolan understands that as the privacy landscape continues to evolve and change, their program will do the same. OneTrust has provided them with a solid foundation and framework for their privacy program that they will continue to grow and build upon.

“It’s been really exciting working with OneTrust as an organization, said Attias. “Their responsiveness, not just in the product, but also as a supplier to the customer, has been really encouraging. We’re excited to continue to evolve our privacy management program as the product continues to evolve.”